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1. Media Monitoring Capability 

The National Operations Center (NOC) Watch, also referred to as the “Watch,” provides critical 
functions and capabilities that are central to implementing responsibilities of the Department of 
Homeland Security (DHS) as mandated by Homeland Security Presidential Directive (HSPD)-5 
and other federal regulations. HSPD-5 designated the Secretary of Homeland Security as the 
Principal Federal Official (PFO) for domestic incident management and required the 
development of a National Incident Management System (NIMS) and a National Response Plan 
(NRP - since superseded by the National Response Framework NRF) as the foundations for the 
nation’s new coordinated approach to domestic incident management. The Watch also serves as 
the National Fusion Center for State Fusion Centers located across the country. The Media 
Monitoring Capability (MMC) desk is an integral component of the Watch. 

As a part of the NOC, the MMC gets operational direction from the NOC Director 
communicating directly or through the Senior Watch Officer (SWO) with the MMC Watch Lead. 
Correspondingly, the governing MMC operational documents are approved by NOC leadership. 
In addition, the SWO or NOC Duty Director (NDD) may request specific information from or 
provide direction to the MMC desks on behalf of the NOC Director. In the event SWO tasks or 
requests conflict with existing direction, especially regarding the Privacy Impact Assessment 
(PIA), on-duty MMC analysts will immediately notify the MMC Program Manager who will 
engage NOC Leadership to resolve the issue. For non-operational direction, such as contractual 
matters, the OPS Contracting Officer’s Representative (COR) provides direction to the Program 
Manager. 

Open source media is a significant source of information during nonnal operations, crises and 
extraordinary events. In advance of and during a crisis, international, national, and local media 
pour into joint operating areas to report on evolving situations. They work aggressively to 
expose the depth and breadth of the crisis, including the extent of the damage and destruction, 
fundamental needs (food, fuel, etc.), impact on critical infrastructure (power and energy grid), 
and federal action(s) and inaction(s). The major news networks continuously stream video, data, 
and stories to the public; monitor pre-crisis, crisis, and post-crisis activities; and highlight issues 
for authorities. In addition, the utilization of cellular telephones with photographic capabilities 
by the public often rapidly provides pictures and commentary via social media. Both breaking 
news and evolving developments in ongoing situations are captured and publicly shared in near 
real time. It is essential to monitor the media’s storylines and integrate their focus into the 
Department’s situational awareness and operations analytical process. Critical situations often 
require the Secretary to make public statements that reflect the Department’s understanding of 
the situation, appreciating the circumstances to which the affected population is exposed, and 
characterizing the federal government’s actions and mitigation efforts. 

The MMC is designed to monitor, analyze, and forward operationally relevant open source 
information to addressees on a NOC-approved distribution list. The MMC is operational 
24/7/365. The MMC assists in framing the operational picture that open source media is 
reporting, uncovering operational issues for incident and emergency management leadership to 
further evaluate, identifying nascent or evolving situations, and providing valuable information 
and imagery that can be used to corroborate and/or reconcile first reports. 


9 




SOP 


2. Mission 

The MMC has three primary missions: 

• Continually update existing National Situation Summaries (NSS) and International 
Situation Summaries (ISS) with the most recent, relevant, and actionable open source 
media infonnation. 

• Dynamically monitor available open source information with the goal of expeditiously 
alerting the NOC Watch Team and other key Department personnel of emergent incident 
management situations such as terrorist activities, natural or man-made disasters and 
public safety. 

• Receive, process, and distribute media captured from streaming sources available to the 
NOC such as Northern Command’s (NORTHCOM) Full Motion Video (FMV) and via 
open sources. 

These three missions are accomplished with strict adherence to the approved NOC MMC PIA of 
Jan 6, 2011 by employing various tools, services, and procedures that are described in detail in 
this document. The primary missions have three key components: 

2.1. Leverage Operationally Relevant Information 

Leveraging news stories, media reports, and postings on social media sites available to the 
public, concerning Homeland Security, Emergency Management, and National Health for 
operationally relevant data, information, analysis, and imagery is the first mission component. 
The traditional and social media teams review a story or posting from different perspectives and 
interests, utilizing thousands of reporters, sources, still/video cameramen, analysts, bloggers, and 
ordinary individuals on scene. Traditional Media outlets provide insight into the depth and 
breadth of the issue, including worsening situations, federal preparations, response activities, and 
critical timelines. At the same time, Social Media outlets provide instant feedback and alert 
capabilities to rapidly changing or newly occurring situations. The MMC summarizes the 
extensive infonnation from these resources to enrich the operational picture for the Department 
of Homeland Security, without including unauthorized Personally Identifiable Infonnation (PII). 

2.2. Identify Operationally Relevant Media 

Supporting the NOC by ensuring they have a timely awareness of evolving Homeland Security 
news stories and media reports of interest to the public and DHS/other federal agencies involved 
in preparations and response activities is the second key component. DHS and other federal 
agencies conducting joint operations may be affected by evolving situations in that area. These 
situations may not be directly related to an ongoing issue but may also have an indirect effect. 
Through coordination with the NDD or the SWO, the MMC works to ensure the NOC Watch 
Team is aware of such stories and news events and has time to analyze any effect on operations. 
In all cases, the MMC follows a protocol for ensuring source credibility and data accuracy. 
Authorized PII is included in the reports only to the extent that it lends credibility to the report. 

Timely reporting of current information is an integral element in maintaining operational 
awareness by Homeland Security personnel. The MMC understands it is vital that critical 
information is relayed to key Department decision makers as expeditiously as possible. 
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2.3. Increase Situational Awareness of the DHS Secretary 

Mitigating the likelihood that the Secretary and DHS executive staffs are unaware of a breaking 
Homeland Security news story or media report is the third component. The Secretary and 
executive staff members are subject to press questions regarding domestic and international 
events, and may or may not be informed of the most current media coverage. The MMC 
understands Critical Infonnation Requirements and NOC Daily Priorities, and monitors news 
coverage with the perspective of how the breaking story may be related to current and other 
important ongoing situations and DHS activities. DHS Senior Leadership, the NOC, and the 
MMC are concerned with and report on what is being reported, not who is reporting it. 

The on-duty MMC analysts alert DHS personnel and related federal agencies of updated news 
stories through distributed Items of Interest (IOI). MMC strives to identify and integrate media 
coverage to report situations of operational relevance that must be brought to the attention of the 
Secretary and/or senior leadership. 

3. Operations 

The Operations section of the SOP provides an overview of the reporting parameters and general 
guidelines for standing a watch shift. Also included are reviews of administrative components of 
the MMC, the different technology suites, and facilities utilized by the capability. 

3.1. Battle Rhythm for MMC Watch 

This synopsis provides a general outline for the flow of a normal watch shift. This can be used as 
a guide for completing watch responsibilities and should be used as a tool for better 
understanding how and when certain tasks should be completed by on-duty analysts. Each of the 
components discussed in the Battle Rhythm will be further explored in subsequent sections of the 
SOP manual. 

3.1.1.Shift Changeover Briefing: 

The oncoming analyst will review each Item of Interest or Update distributed during the 
previous watch, making sure to understand the overall coverage that was provided during 
the previous 24 hours, as well as identify any themes or ongoing incidents. Once this 
review is completed, the outgoing analyst will provide the oncoming analyst with a 
thorough briefing of the NOC Priorities and any active NOC items: 

• National Situation Summaries (NSS) [Phase Reports] 

• International Situation Summaries (ISS) [Phase Reports] 

• Awareness Reports 

• Events of high media interest 

• Requests for Infonnation (RFI) from the NOC Watch Team, DHS Senior Staff 

• Instructions/ New Guidance from MMC Management 

• Items that meet the criteria for inclusion in the MMC OPSUM 

The outgoing analyst is also responsible for verifying that all equipment is correctly 
operating before the shift is turned over. Once the changeover briefing is completed, 
both analysts will sign the changeover checklist. 
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3.1.2.NOC Priorities 

The NOC will produce a list of priorities each day for the ensuing 24 hom period. This 
list will be disse m inated via email and will be used to shape the monitoring and coverage 
provided by the MMC staff. Priorities will provide a description of active events, 
including National Situation Summaries, International Situation Summaries, and 
Awareness Reports. The NOC Priorities will also identify events of high media interest. 


3.1.3.Watch Responsibilities 

While on shift, the MMC analysts are responsible for monitoring internet based tools, 
websites, and forums, as well as constantly observing television-based news broadcast to 
track such things as terrorist activities, natural or man-made disasters, public safety, and 
damage CIKR. Through continued monitoring, analysts will provide timely reporting of 
Items of Interest based on pre-established criteria, categories and Critical Information 
Requirements. Once the analyst has assumed the watch desk, he/she will: 






Collaborate with his/her counterpart on either the traditional or social media desk 
to discuss the priorities for the shift and any other potential incidents that may 
require specific attention. 

Log in to all necessary progr ams, including: the MMC Application, Google 
shared documents, the daily log, RSS Owl, Shrook, NewsDesk, Tweetdeck or 
other web-based search tools. 


Ensure that all communication and information exchange programs are open and 
operating correctly, including: the Homeland Sec urity Information Net work 
(HSIN), the Common Operational Picture (COP), 

and Microso ft Comm unicator (Instant Messenger), 
o Once logged in to jjtf 


_Kl||. notify the NOC staff that you have assumed the 

watch. Access the NOC-Watch chat room and enter: (Your Name) has 
assumed the NOC Media Monitoring (Traditional Media/ New Media) 
Watch Desk. 


o 


is unavailable, contact the SWO/KMO by telephone at: 



Initial searches should include those that either focus on pressing NOC Priorities, 
ongoing incidents or those that involve First Tier sources such as those discussed 
innnediately below. If there are no open items that require inmiediate follow up: 


• Traditional Media analysts should focus on reviewing major print media sources 
such as: Washington Post, New York Times, LA Times, USA Today, The 
Associated Press, FOX News, CNN, MSNBC. Reuters, BBC, and A1 Jazeera. 

• Social/New Media analysts should focus on reviewing major blogs and media 
outlet Twitter feeds such as: Breaking News Online, Criminal Justice Online, 
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Borderland Beat, Huffington Post, Tweetdeck, InciWeb, Guerra Contra El Narco, 
Global Terror Alert, Twitter Trends Map and Wired Update. 

If infonnation is not readily available on First Tier sources, analysts should search more 
local or issue specific web-pages. As the shift continues, analysts on both desks should 
find themselves rotating between scanning First Tier sources, searching lower level 
sources and monitoring RSS Feeds and other monitoring tools. Once a search cycle is 
completed, the analysts can begin again at the top. While analysts are mainly focused on 
distributing “breaking” news alerts and updates as infonnation becomes available, they 
should also be trying to reach a goal of sending out one item every hour. In an average 
shift, the Media Monitoring Capability should send out approximately 24 (12 Traditional 
Media/12 Social Media) Items of Interest or Updates. 

3.2. Technology Suite 

The Media Monitoring Capability is located off the DHS campus. The Traditional Media and 
Social Media watch desks share a space equipped with an advanced audio video package, 
allowing analysts to constantly monitor multiple computer programs as well as television 
network broadcasts at the same time. The technology suite greatly assists the analysts in 
identifying the most relevant sources and infonnation to be included in the reports. The analysts 
must be vigilantly attentive to not inadvertently include PII in the reports. The team relies upon 
internet and cable/satellite for most of its infonnation retrieval. Intemet/Cable/Satellite 
connectivity is provided via commercial contracts. Four large Plasma TVs and computers with 
multiple screens on each desk enable MMC analysts to perform several tasks (e.g., process 
video, monitor news broadcasts, compose e-mail) simultaneously. 

• The cunent suite of equipment on the Traditional Media desk includes one Dell Optiplex 
GX620 workstation (232 GB HD/2MB RAM), one MAC desktop workstation, and three 
22” flat screen monitors, and individual analysts are issued a laptop that is used to 
augment the PCs and to provide a remote capability for surge operations, inclement 
weather, or other exigencies. 

• The current suite of equipment on the Social Media desk includes one MAC desktop 
workstation, two 19” flat screen monitors, and individual analysts are issued a laptop that 
is used to augment the PCs and to provide a remote capability for surge operations, 
inclement weather, or other exigencies. 

• Four 40” Samsung flat screen TVs are mounted on a wall in front of the desk and can be 
viewed from analysts working at either station. The monitors/TVs are equipped with MSI 
TV Tuner Cards to facilitate radio/TV display and video capture. The system also allows 
for analysts to change video inputs so that they can display any program that they are 
utilizing on computers at their desk onto the 40” monitors at the front of the room. This 
capability helps to facilitate the rapid sharing of information with others in the office as 
well as display of important infonnation, such as the Common Operational Picture. 

• To facilitate communication with the National Operations Center (NOC), the MMC has 
two phones - a voice over IP phone on each desk and a cellular phone. There is also a 
pager that the NOC utilizes to disseminate infonnation for ongoing incidents. The MMC 
office phone is for general business purposes only while the cell phone is used to receive 
blast calls from the NOC, interact with MMC and NOC personnel, and as a back-up if the 
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landline goes down. The pager is used to receive alerts on NOC Notes, Phase Reports 
and other related event situations. 



Figure 1: MMC Watch Desk 



Figure 2: MMC Front of Room Monitors 
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3.2.1.Television Monitors: Video Switch 

In order to change the channels for the displays at the front of the MMC office, analyst 
must access the MMC network at: (see account information sheet) 

It’s probably a good idea to have this interface available during your shift, so that you can 
make any adjustments on the fly. 

Manual Switching 

Using the matrix of Inputs (along left side) and Outputs (along top side) you can quickly 
click which source you would like to display on any one of 5 outputs. Selection is made 
by clicking the button that references the combination of Input and Output you wish to 
see, and then click the “Submit” button at the bottom of the page. Outputs 1 through 4 
correspond to the TVs left to right, from top row to bottom row: 


ONE 

TWO 

THREE 

FOUR 


Figure 3: MMC Monitor Set Up 


Output 5 allows you to assign the audio of any input to the overall room speakers. 

Stored Configurations 

To make common configurations easily and quickly available, we have set up some 
presets. By selecting the number from the drop-down menu under “Stored 
Configurations” and clicking “Load”, you can call up these stored presets. These settings 
can be changed if we find specific presets that are preferred. 

1) MMC Extended Desktop HSIN (1), CNN (2), FOX News (3) MSNBC (4). 

2) MMC Extended Desktop HSIN (2), CNN (1), FOX News (3) MSNBC (4). 

3) MMC Extended Desktop HSIN (3), CNN (2), FOX News (1) MSNBC (4). 

4) MMC Extended Desktop HSIN (4), CNN (2), FOX News (1) MSNBC (3). 

5) SN Extended Desktop HSIN (1), CNN (2), FOX News (3) MSNBC (4). 

6) SN Extended Desktop HSIN (2), CNN (1), FOX News (3) MSNBC (4). 

7) SN MAC Desktop HSIN (2), CNN (1), FOX News (3) MSNBC (4). 

8) SN MAC Desktop (3), CNN (1), FOX News (2) MSNBC (4). 
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3.2.2. Mapping Shared Network Drive 

To map to MMC’s shared network drives, use the following procedures. When mapping for the 
first time, you must enter the password (see hard copy of password list in the left pocket of the 
SOP binder). 

For Windows XP computers: 


1) Click Start 

2) Click My Computer 

3) Click on Tools 

4) Select Map Network Drive 

5) Select any letter from the dropdown menu for the Drive 


6) Type in the following under the Folder space for the MMC shared drive 


a. For the SN shared drive, type in [Jj 


b. The box for “Reconnect at Logon” should be checked 


c. Do not check the box for “Connect using different credentials” 


7) Click Finish 


For Windows 7 computers: 


1) Click Start 

2) Click My Computer 

3) Select Map Network Drive from the top menu bar 

4) Select any letter from the dropdown menu for the Drive 

5) Type in the following under the Folder space for the MMC shared drive 


(b) (7)(A), (b) (7)(E) 


a. For the SN shared drive, type in It 



b. The box for “Reconnect at Logon” should be checked 


c. Do not check the box for “Connect using different credentials” 


d. Click Finish 


3.3. Shift Schedule 

The Media Monitoring Capability (MMC) maintains 24/7 operations 365 days per year. 

Analysts work a 12-hour watch shift from either 0600-1800 (day) or 1800-0600 (night). Those 
not on a 12-hour watch will work an administrative shift from 9-5. The schedules for the 
Traditional Media and Social Media teams will be offset in order to ensure that administrative 
coverage is provided for the entire work week. Referred to as “Project Time,” analysts will use 
this week of 8-hour administrative shifts to complete weekly reports, assist the MMC watch, and 
complete additional tasks as directed by senior DHS/NOC/MMC personnel. The rotating watch 
schedule follows a general pattern of 2 days on, 2 days off, 3 days on, 2 days off, 2 days on, 3 
days off. Analysts work this schedule for two weeks. Once a two-week rotation is complete, the 
analyst who worked the day shift will automatically switch to night shift. The analyst who 
worked two weeks on night shift will then work on Project Time. 
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Figure 4: MMC/SN Schedule Format 


Figure 4 shows the work schedule of eleven analysts broken down into 2 teams to provide 24/7 operations. A fifth person 
will usually be on project time and eventually rotate into day shift after Project Time. 

The schedule is a 6-month projection, which allows analysts to know their schedule and plan for time off, etc. Note: If an 
analyst is scheduled to work a 12-hour shift and needs the day off, he or she will coordinate with other analysts and the 
team lead to ensure that coverage is maintained. The schedule is distributed as an Excel document via email at regular 
intervals, but is also available through Google Docs: (see account information sheet) 

4. Distributions 

4.1. Item of Interest (IOI) Parameters 

MMC coverage focuses primarily on providing information on incidents, significant events and 
crises, which are usually defined as catastrophic events that result in wide-scale damage or 
disruption to the nation’s critical infrastructure, key assets, or the nation’s health; and require a 
coordinated and effective response by Federal, State, and Local entities. For the most part, 
coverage of international incidents is limited to that of terrorist activities and infectious diseases 
that impact a wide population of humans or animal stock, such as mad cow disease or H5N1, and 
catastrophic weather events around the globe (Category 5 Hurricanes, Tsunami, and Large 
Magnitude Earthquakes). An Item of Interest (IOI) is generated whenever an MMC search or 
alert produces information about an emergent incident that should be brought to the attention of 
the NOC. The emphasis in IOI reporting is always focused on operationally relevant 
information, the “what” versus the “who.” In preparing and distributing IOIs, analysts must 
only include authorized PII. Further, analysts must consider whether inclusion of authorized PII 
lends credibility to the report before distributing an IOI containing authorized PII. Often PII may 
be found in the text of the reports when referring to specific individuals or in the text of the 
source links (e.g., https://twitter.eom/#l/sallyreporter). 
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Note - If there are ANY questions about whether an incident or other reported item is IOI- 
worthy, check with MMC leadership. 

4.1.1.Incidents that warrant an IOI: 

• Terrorist incidents (including foreign countries) 

• Major natural disasters (e.g., floods, tornadoes, earthquakes) 

• Transportation incidents where major bottlenecks may occur or where 
chemical/explosive hazards exist 

• Incidents that could result in injury to a local population (e.g., fire at a chemical 
production facility releasing toxic fumes) 

• Incidents that result in damage to critical infrastructure 

• Safety issues (e.g., aircraft emergency) 

• Certain crimes (e.g., snipers, mall/school shootings, major drug busts, illegal 
immigrant busts, etc) 

• Policy directives and implementations operationally related to DHS 

Note - Analysts are to refrain from generating IOI reports that: 

1) Include any form of unauthorized PII 

2) Include public reaction to DHS programs, policies and procedures unless they are 
operationally relevant (e.g., long wait times at TSA checkpoints) 

3) Focus on individuals’ First Amendment-protected activities unless they are 
operationally relevant (e.g., protest shuts down 1-95 - in which case the report 
should focus on impact to operations and not the subject of the protest) 

4) Overview proposed legislation or legal challenges on enacted legislation 

5) Have an obvious political bias or agenda 

6) Are predictive or futuristic 


4.1.2.NOC Comprehensive Critical Information Requirements (CIR) & Essential Elements 
of Information (excerpt applicable to MMC) 

CIR #1 - Facts, Estimates & Projections about the Threat, Incident, Event or Storm: 

a. Chemical or Biological Attacks 

What Information is known about the chemical or biological agent of concern and what are 
typical symptoms indicating exposure? 

What are the safe and dangerous exposure levels, related medical procedures and/or 
antidotes? 

What are the known distances from the location of release from major population centers? 
What do the plume modeling and forecasts indicate? 

Is there infonnation on documented water and food contamination? 

b. Cyber Attacks 

What are the critical facts about the extent of the cyber attack? 

Were any key national programs or data systems targeted, exposed or impacted? If exposed 
or impacted, what is the known extent of the damage or compromise of data? 

Is there an estimated source of attack and other relevant information regarding the cyber 
attack? 

c. Earthquakes 
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Where exactly was the epicenter of the earthquake located and provide details in relation to 
the distances from major metropolitan center(s) or landmark(s).? 

What were the Richter scale measures of the earthquake? 

How far apart in distances throughout the region was the earthquake felt or impacted? 

What is the estimated population most affected by the earthquake? 

What are the anticipated aftershocks and for what period / duration will they last? 

d. Explosions 

What are the critical facts about the explosion (i.e. source(s) or agent(s) or explosive 
materials used)? 

What were the measures or estimates of the explosion’s force? 

What was the location of impact to buildings? 

Are any Critical Infrastructure or Key Resources affected? 

e. Fires 

Where is the fire located? 

What is the distance from the fire to populated areas (i.e. residential, business, etc)? 

What is the size of the fire? 

What percentage is contained? 

Are there any forecasted and/or factual issues for consideration? 

Do fire officials suspect a cause of the fire? 

Has a Fire Management Assistance Grant (FMAG) been requested and/or approved? 

f. Floods 

What are the projected or estimated flood levels? River levels? Estimated peaks? 

What are the cities and population centers impacted (or will be impacted)? 

g. Hurricanes 

What Hurricane category applies to this stonn? 

What are the maximum and sustained winds? 

What and where is the anticipated stonn surge and flooding risk? 

What is the stonn diameter, location of eye, barometric pressures, and projected track? 
When is the anticipated landfall date/time and where is the storm projected to anive at? 

h. Oil Spill of National Significance or Hazardous Material Spill 

What are the critical facts about the oil or hazardous material spill (i.e. estimates on size and 
rate of spill, current location, and sources(s) and date/time of spill)? 

What do computer projections or modeling indicate with respect to spill drift speed and 
direction? 

What are considered to be safe and dangerous exposure levels (if applicable)? 

Has a responsible party for the spill been identified? (MMC must never include PIT) 

Are there any sensitive environmental areas (i.e. Wildlife Preserve, Conservation Areas, 
Habitats, etc) that could be adversely impacted by the spill? 

What other relevant information about the spill must be considered? 

i. Mass Migration 

What are the estimates of total migrants attempting to migrate? 

What are the likely countries of origin and U.S. destinations? 

How many migrants have been intercepted or rescued to date? 

Are there any fatalities or serious injuries? 

j. Nuclear and Radiological Attack, Incident, or Release 

What is the source of the release? 
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What are the current radiation levels at the various rings / distances from the release location 
and from major population centers? 

What do plume modeling forecasts indicate for radiation contamination? 

Have any safe and dangerous exposure levels been identified? 

Is there infonnation on documented water and food contamination? What agencies are 
responsible and in charge of monitoring this threat? 

k. Pandemic Influenza or Outbreak 

What is the critical infonnation regarding the nature of the pandemic or influenza outbreak? 
Have incubation periods been identified? 

What are the associated symptoms with this outbreak? 

Are there any special concerns for elderly persons or infants? 

Are there any prescribed medical treatments or shots identified and/or available? 

l. Special Events 

What are the critical facts/infonnation about the event (i.e. security, location, facilities, etc)? 

m. Suspicious Activity or Suspicious Package 

What are the critical facts about the suspicious activity or package, including a description of 
the activity or package, the location and nearness to major population centers or landmarks 
and the proximity to critical infrastructure or facilities? 

List other pertinent details on what local law enforcement authorities have been notified (if 
any); or details on what explosive ordinance responders have been notified (if any). 

n. Terrorism Threat 

What are the specific details of the credible threat (methods and means for carrying out the 
threat, etc)? 

o. Tornadoes and Other Severe Weather 

What are the critical facts and description of the tornadoes or storm (to include maximum 
and sustained winds, storm diameter, location, and barometric pressures)? 

What is the projected track of the stonn? 

What is the anticipated landfall date/time and arrival location? 

p. Tsunamis 

What are the estimated wave heights, location, and duration of the tsunami? 

What is the estimated date/time to arrive at Continental U.S. (CONUS) shores or major 
population centers? 

What is the estimated speed and direction of the tsunami? 

Is there a discrepancy between observed versus forecasted data? 

CIR #2 - DHS Readiness & Preparedness: 

a. National Terrorism Advisory System (NTAS) 

What are the pertinent details of any threat that drives an NTAS alert (i.e. type of threat, 
source, timeline, potential impact to public, etc)? 

What are the recommended preventive measures to take in order to heighten public safety (by 
communities, businesses, and government entities) e.g. lockdowns, evacuations, etc.? 

b. DHS Protective Measures and Actions 

What are the DHS protective measures or mitigation steps being exercised or planned to limit 
the impact to DHS mission readiness and response operations? 

What offices, teams or task forces were impacted of affected by this threat, event or incident, 
if any? 
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What is the status of DHS’s specialized teams needed to respond to this threat, incident or 
storm? 

What are the DHS protective measures or mitigation plans or actions being exercised or 
planned for responding to this terrorist threat, e.g. personnel surge, physical steps, EOC set 
up, etc.? (Note, this info is important for CIKR facilities or transportation infrastructure 
especially). 

What are the estimated effects these protective measures or mitigation plans have on national 
supply system, key transportation nodes or commerce, if any? 

Are there any advisories or public warnings being issued? 

CIR #3 - Other Federal, State, Local Readiness & Mitigation Actions: 

a. Evacuation Plans and Estimates 

What is the general evacuation plan for this event or incident? 

o What is the estimated number of general population requiring evacuation? 
o Have federal, state, tribal, territorial, and/or local authorities identified any areas for 
evacuation (mandatory or voluntary)? 

What is the status of evacuation orders, if any? 

Have there been any problems with personnel evacuation or applicable evacuation plans? 
What is the rough re-entry plan for the evacuated general public to return? 

Will there be any quarantine required or anticipated for the public prior to re-entry? If so, 
what are the essential details? 

b. Changes to Security Levels or U.S. Conditions of Readiness 

Has this threat, incident or event resulted in changes to any U.S. condition of readiness, such 
as Department of Defense Condition (DEFCON), Force Protection Condition (FPCON), 
Infonnation Operations Condition (INFOCON) or USCG Maritime Security (MARSEC) 
Levels? 


Note: CIR 4 is not applicable to MMC 

CIR #5 - Life Saving & Critical Resources / Shortages: 

a. Status of First Responders 

How has this event or incident affected the first responders’ (fire, police, medical) ability to 
provide needed support to the affected communities? 

Is there a Mutual Aid agreement already in place among regional fire, police, and emergency 
medical services? If so, what are the pertinent details? 

What is the re-entry plan for first responders? 

What is the status of medical response personnel? 

Is there an anticipated need for search and rescue operations as a result of this event or 
incident? If so, what DHS agencies and assets will be providing support or likely be used? 
What is their status? 

What Department of Defense assets are likely to be used? What is their status? 

What National Guard assets are likely to be used? What is their status? 

b. Life Saving & Other Critical Response / Recovery Actions 

What are the major or critical requests for assistance that DHS is responsible for or 
responding to? 
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o Who made the request(s) and what are the relevant dates/deadlines of the request 
(e.g. Foreign State, Department of State, state, local government, etc)? 

What are the major DHS assets or teams requested or already responding to this incident (i.e. 
IMATs, Vessels, Teams, etc)? 

What major operational response actions are being taken in response to the threat, event or 
incident? 

c. Status of Food, Water, Shelter, Power, and Communications 

What is the status of food, water, shelter, power and communications in the affected region? 

d. Critical Resource Gaps, Unmet Needs, and Medical Shortfalls 

Has any Federal, State or Local government or responding agency identified any critical 
resource gaps or major operational response or asset gaps that cannot be resolved? 

e. Status of Coast Guard Reserve Personnel 

Has the President authorized the recalling of Title 10 forces to provide support as a result of 
this event or incident? 

Has the U.S Coast Guard activated their Coast Guard Reserve workforce? What are the 
associated details? 

CIR #6 - Damage & Restoration: 

a. CIKR (Level One) Damage Estimates and Restoration Actions 

What major Critical Infrastructure and Key Resources (CIKRs) will likely be impacted or 
have been impacted as a result of this event or incident? 

Which impacted CIKRs are the most critical to recovery operations? 

What is the projected damage or impact to these CIKRs as a result of this event or incident? 
o What are the likely cascading effects that will ensue as a result of the damage to 
these listed CIKRs? 

o What is the long term (greater than 6 months) regional, state and national impact 
as a result of the damage to these listed CIKRs? 

What are the major DHS restoration activities being executed to help restore CIKR facilities 
and infrastructure? 

b. Other CIKR Damage Estimates 

What other Critical Infrastructure and Key Resources (CIKRs) will likely be impacted or 
have been impacted as a result of this event or incident? 

What is the projected damage or impact to these CIKRs as a result of this event or incident? 
What are the major DHS restoration activities being executed to help restore CIKR facilities 
and infrastructure? 


CIR #7 - People: 

Status of U.S. Public (in General) 

What are the general estimates for number of U.S. citizens impacted or projected to be 
impacted by this threat, event or incident? 

What is the estimated and confirmed number of deaths, injuries or missing persons as a result 
of this event or incident? 

What is the estimated number of personnel and special needs personnel that might require 
rescuing as a result of this event or incident? 
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How many homes were destroyed or damaged as a result of this event or incident? 

How many personnel are estimated and confirmed to be homeless as a result of this event or 
incident? 

CIR #8 - Health & Safety: 

a. Major Health Concerns and Estimates 

What are the general estimates for number of U.S. citizens impacted (or will be impacted) by 
this health-related event or incident? 

What are the anticipated effects to U.S. health as a result of this event or incident? 

What are the current estimates or confirmed cases of individuals with communicable disease, 
pandemic like symptoms or confirmed diagnosis? 

What are the worst case estimates for communicable disease and/or pandemic outbreak as a 
result of this event or incident? 

b. Quarantine & Similar Health and Safety Plans 

Are there any plans by the Federal, State, or Local government to implement quarantine 
plans in response to an incident or threat? 

CIR #9 - Response and Recovery Organization & Leadership: 

Lead Agency, Response and Recovery Organization(s) 

Who is the lead Federal, State, and Local agency responsible for responding to this threat, 
incident, event or storm? 

What is the primary State or Local Emergency Operation Center (or similar command) 
established to coordinate all the state and local response actions to this incident? 

CIR #10 - Long Term Recovery and Economic Impacts: 

a. Estimates on Long Term Recovery Operations 

What are the damage estimates as a result of the impact from this event or incident? (Note: 
please provide specific emphasis on damage estimates to the communications, energy, and 
transportation sectors.) 

What are the major long term effects (greater than 6 months in duration) as a result of this 
event or incident? 

What is the estimated recovery time from this event, incident or storm? 

b. Economic & Other Strategic National & Long Term Consequences 

What is the estimated strategic U.S. National impact resulting from this event or incident? 

o What is the anticipated impact on the U.S. economy? 

What is the anticipated impact on the U.S. environment? What are the estimated long term 
consequences to the geographic region affected by this incident or event? 

CIR #11 - Public Information Guidance 

What additional information regarding this incident and DHS’s role in it can be found 
amongst popular social networks, press releases, and public statements? 

CIR #12 - Weather and Seas 

What is the forecasted weather and seas (e.g. next 72 hours) for the area(s) or region(s) in 
question or in the area(s) where DHS operations are ongoing? 

Any other relevant high-level weather related information 
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4.1.3.IOI Categorization 

The categorization of IOIs in the daily log allows analysts to track the types of articles 
that are distributed as they relate to 13 characterizations. The emphasis in IOI reporting 
is always focused on operationally relevant information, the “what” versus the “who.” In 
preparing and distributing IOIs, analysts take great care to never include unauthorized 
PII anywhere in the report, including within the text of the source link. The 
characterizations include: 

1) Terrorism: Includes media reports on the activities of terrorist organizations both in 
the United States as well as abroad. This category will also cover media articles that 
report on the threats, media releases by al Qaeda and other organizations, killing, 
capture, and identification of terror leaders and/or cells. (Reports in this category 
CANNOT include the name of the terrorist unless deceased.) 

2) Weather/Natural Disasters/Emergency Management: Includes media reports on 
emergency and disaster management related issues. Reports include hurricanes, 
tornadoes, flooding, earthquakes, winter weather, etc. (all hazards). Reports will 
outline the tracking of weather systems, response and recovery operations, as well as 
the damage, costs, and effects associated with emergencies and disasters by area. 

Will also include articles regarding requests for resources, disaster proclamations, and 
requests for assistance at the local, state, and federal levels. 

3) Fire: Includes reports on the ignition, spread, response, and containment of 
wildfires/industrial fires/explosions regardless of source. 

4) Trafficking/Border Control Issues: Includes reports on the trafficking of narcotics, 
people, weapons, and goods into and out of the United States of an exceptional level. 
Reports will also include articles outlining the strategy changes by agencies involved 
in the interdiction of the items outlined above. 

5) Immigration: Includes reports on the apprehension of illegal immigrants, policy 
changes having operational implications with regard to immigration in the United 
States, and border control issues. (Reports in this category CANNOT include the 
names of illegal immigrants.) 

6) HAZMAT: Includes reports on the discharge of chemical, biological, and 
radiological hazardous materials, as well as security and procedural incidents at 
nuclear facilities around the world and potential threats toward nuclear facilities in the 
United States. Also included under this category will be reports on, and responses to, 
suspicious powder incidents and chemical or biological agents. 

7) Nuclear: Includes reports on international nuclear developments, attempts to obtain 
nuclear materials by terrorist organizations, and stateside occurrences such as melt 
downs, the mismanagement of nuclear weapons, releases of radioactive materials, 
illegal transport of nuclear materials, obtaining of weapons by terrorist organizations, 
and breaches in nuclear security protocol. 
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8) Transportation Security: Includes reports on security breaches, airport procedures, 
and other transportation-related issues. Reports will include threats toward and 
incidents involving rail, air, road, and water transit in the United States. 

9) Infrastructure: Includes reports on national infrastructure, including key assets and 
technical structures. Reports will include articles related to failures or attacks on 
transportation networks, telecommunications/ internet networks, energy grids, 
utilities, finance, domestic food and agriculture, government facilities, and public 
health. 

10) National/International Security: Includes reports on threats or actions taken against 
United States national interests both at home and abroad. Reports will include 
articles related to threats against American citizens, political figures, military 
installations, embassies, and consulates, as well as efforts taken by local, state, and 
federal agencies to secure the homeland. Articles involving intelligence will also be 
included in this category. 

11) Health Concerns, National/International: Includes reports on national and 
international outbreaks of infectious diseases and recalls of food or other items 
deemed dangerous to the public health. 

12) Public Safety: Includes reports on public safety incidents, building lockdowns, 
bomb threats, mass shootings, and building evacuations. 

13) Cyber Security: Reports on cyber security matters that could have a national impact 
on other CIR Categories; internet trends affecting DHS missions such as cyber 
attacks; computer viruses; computer tools and techniques that could thwart local, state 
and federal law enforcement; use of IT and the internet for terrorism, crime or drug- 
trafficking; and Emergency Management use of social media. 


4.1.4.IOI Relevancy Rating Scale 

The Item of Interest (IOI) Relevancy Rating Scale is a tool that provides MMC analysts 
with a process to assess the relevancy of a news story to DHS Operations and the urgency 
in which the corresponding IOI should be distributed. Detennining the relevancy of an 
IOI allows analysts to triage news stories and send out time-sensitive pieces first, 
followed by less acute stories. The IOI Relevancy Rating Scale is broken down into five 
categories, from “Absolutely Send” to “Do Not Report.” 


Rating 

Threat Assessment 

Distribution 

5 - Absolutely Send 

DHS OPS relevant/Breaking news - time 
sensitive 

Immediate 

4 - Send, not time sensitive 

DHS OPS relevant, but not time sensitive 

Not time sensitive 
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3 - Continue research and either rate as 
send or do not send 

DHS relevance/Determine if worth 
distribution 

Must determine if Category 

4 or Category 2 

2 - Marginal DHS Relevance 

Marginal DHS relevance/Not in line with 
reporting guidance 

Must be approved by MMC 
leadership for distribution 

1 - Absolutely SHOULD NOT BE 
Reported 

Not operationally relevant 

None 


4.1.5.Sourcing Items of Interest 

Identifying the source of infonnation allows the MMC to record the means by which 
articles are discovered. This does not involve recording PII of the specific content 
authors, but instead involves recording general source categories within either traditional 
or social media as noted below. Such metrics support MMC analysts/management in 
reviewing the productivity of certain tools/processes to assist in process improvement and 
quality assurance efforts. Characterization of sourcing includes: 

Traditional Media 

1) Live Broadcast: The Item of Interest was distributed following live television 
broadcast by FOX News, CNN, MSNBC, etc. 

2) Alert: The Item of Interest was initiated because of an alert from the NOC. 

3) Passive Scan: The Item of Interest was produced following the finding of an 
article as the analyst searched websites (Foxnews.com, CNN.com, BBC.co.uk, 
etc.) or through the use of the MMC’s aggregator tools. 

4) Active Search: The Item of Interest was distributed after the analyst found an 
article by seeking out certain topics in search engines (Google, Yahoo, MSN, etc.) 

Social Media 

1) Credible Source: The item of interest was distributed following information 
provide by a credible source, such as a twitter posting by a media outlet 

2) Credible Evidence: Information is provided by social media sources, but is being 
redistributed by other users or media outlets, lending credibility 

3) Corroborating “Hits” Indicating a Trend: The item of interest was produced from 
multiple social media different sources providing an overall picture of the event 

4) Official Alert: A notification posted by an official government or private sector 
source 
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4.1.6. Adding Search Terms & Sites: 

All of the tools utilized by the Traditional and Social Media teams are highly effective 
resources for locating salient infonnation on breaking or evolving situations of interests to 
the DHS NOC. While these tools are all established in a standardized manner, it becomes 
necessary as situations develop, to add, edit, or adjust the search and source parameters that 
are used. When necessary, the protocol below will be followed for adding search terms or 
sources to MMC tools: 

1. The Watch analyst will identify the source or keyword that he/she would like to utilize 
within MMC tools or general internet browser searches and submit it to the Watch Lead 
(Senior Analyst on shift). 

2. The Watch Lead will approve or disapprove of the keyword term or source. If the Watch 
Lead believes that the source or keyword will add value or provide greater granularity to 
established searches, the item will be added to MMC tools/searches. 

3. A note regarding the addition of a new keyword or source will be entered into the 
MMC’s Daily Log, and a message identifying the change will be sent to MMC 
management. The new keyword term or source will also be provided to oncoming 
analysts during the next shift changeover brief. 

4.1.7. Credible Sources for Corroboration 

First Tier - A first tier source is one that does not typically need additional corroboration 
prior to release. Sources that construct the first tier platform include major news 
networks, such as CNN and Fox; major newspapers, such as USA Today and The 
Washington Post; and international news, such as the BBC and The International Herald 
Tribune. These sources do not typically need additional corroboration prior to release: 

o Major news networks (Television and Internet) 

■ CNN, FOX, ABC, NBC, CBS, MSNBC, Associated Press, Reuters (local 
affiliates of these major networks can be considered Tier 1 sources) 

■ Local affiliates of major networks, preferably sourced by the wire services 
like AP or Reuters 

o Major newspapers 

■ Washington Post, LA Times, USA Today, US News and World Report, 
Wall Street Journal, Chicago Tribune, Houston Chronicle, Boston Globe, 
Arizona Republic, San Francisco Chronicle, Detroit Free Press, Miami 
Herald 

■ Some major local/state newspapers are appropriate as well (New York 
Daily News, Chicago Sun Times, Minneapolis Star Tribune, Seattle 
Times, etc.) 

o International News 

■ BBC, Sky News, UPI (United Press International), IHT (International 
Herald Tribune), AFP (Agence France-Presse), Asian Times Online, A1 
Jazeera English, Prensa Latina (Latin American News Agency), The 
Guardian, Le Monde (France), The Economist, Kyodo News (Japan), The 
Australian News, German News, Canada Free Press, Agenzia Italia, 

United News of India, EFE (Spain), ARI (Russian Infonnation Agency), 

Other Sources - Need to be verified by a First Tier source prior to release. 


27 



SOP 


o Government or specialized sites with a specific focus. Often includes .org’s, 
.net’s, and .co’s. 

■ AllAfrica.com, Emergency and Disaster Management Service, 
GlobalSecurity.org, etc. 

o Obviously partisan or agenda-driven sites (political bias must never be reflected 
in an IOI) 

o Tabloids (national and international) 

■ The Sun (UK), National Enquirer, Star, etc. 
o Blogs, even if they are of a serious, political nature 
o Popular magazines 

■ People Weekly, Washingtonian, etc. 
o News collection/ compilation sites 

■ NationalTerrorAlert.com, Drudge Report.com, DisasterNews.net, 
Opensourceintelligence.org, Homelandsecurityleader.com, 

Homelands ecurityT oday. com. 


4.2. Item of Interest (IOI) Creation 

The creation of an IOI is a multi step process that involves analysts at both desks. The MMC 
utilizes a double verification process to strictly adhere to Privacy Guidelines, reduce the potential 
for errors and ensure that all IOIs meet the qualifications for distribution. No matter which desk 
is creating the IOI, his/her counterpart on the opposite desk is responsible for reviewing the item 
for content, spelling, grammar, punctuation, format and PII compliance. 

There are two ways in which an analyst can produce IOIs. The primary method involves the use 
of the MMC Application (App), a specialized data entry tool that categorizes, databases, and 
distributes IOIs. Should the App fail, analysts can utilize Microsoft Outlook to generate IOIs 
manually. Every IOI will have the same general appearance, independent of distribution 
method: 

• Font: Times New Roman • Bold Appropriate Headings 

• Size: 12 Point • Analyst’s Signature Block 

• Recipient’s Address In BCC Line (Applicable in Outlook only) 


4.2.1.Application - IOI (Traditional Media) 

The MMC team utilizes the App as its regular method for distributing IOIs. The App is a 
worksheet-like function that requires the analyst to input data into specific fields, 
resulting in a correctly formatted IOI once published. The App automatically databases 
each item that is distributed, which results in an automated numbering of distributions. 
This means that when creating an IOI, the new report will be sequentially numbered, 
building on previous distributions. When analysts are generating an update for an IOI, 
they only have to make sure that they are updating the correct string (incident) and the 
App will automatically ensure that it is correctly numbered. 

Analysts are responsible for: 
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• Generating a subject line that summarizes the main points of the article in a clear 
and concise manner and entering it in the proper field 

• Selecting the correlating category(ies) 

• Selecting the most specific location possible from the drop down menu 

• Copying and pasting relevant points from the article into the text field 

• Identifying the specific media source and entering it in the proper field 

• Copying and pasting the source link into the correct field 

• Selecting the method used to find the article (Sourcing) 

• Inserting tags (keywords) 

• Selecting the collect distribution list(s) (Default, LIMDIS, SPECDIS) 

• Proofing the entire report 

• Verifying that the format is collect 

• Ensuring that no PII is included except when authorized by the approved NOC 
MMC PIA dated Jan 6, 2011 

• Verifying it is operationally relevant and compliant with the Media Monitoring 
Guidance Reminder memo (Appendix B) 
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MMC: Search Page MMC: Add Report 



Figure 5: MMC App - Traditional Media 
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4.2.2.Outlook - IOI (Traditional Media) 

If the App is unavailable, analysts can generate an IOI via Microsoft Outlook using the 
following process: 

• Open a new message in the Outlook program 

• Insert the format text into the message or type layout. An easy way to get the 
format is to copy it from a previous IOI 

• Generate a subject line that reflects the main points of the incident. When 
applicable, include a location. 

• Add the location of the incident. Ensure this is the actual incident site and not the 
location of the journalist or news source. 

• Insert the article’s text. 

• Insert the article’s source and link. 
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Location: (Region A aaonSiate.Locadtity) 

[Summary] 

Traditional Media Sources (some page content may change er not be available over ttraey 

- f Source Title] 

— F^ouice L:r.k 7 

[Analyst Name) 

Operations Analyst 

DHS -NOC Media Mom luring 

Phone: 

Cell: ?0 


Figure 6: MMC IOI - Outlook Format 


When adding information into the application/email, it is imperative that the analyst 
reviews the article for internal errors, such as spacmg or grammar. Using the preview 
mode prior to distribution, and then copying and pasting the item into a word document is 
a simple way to ensure that there are no spelling or grammar issues. Errors can also be 
checked in Outlook prior to publishing. 

4.2.3.Applieation - IOI (Social Media) 

The SN team utilizes the App as its regular- method for distributing IOIs. The App is a 
worksheet-like function that requires the analyst to input data into specific fields, 
resulting hi a correctly formatted IOI once published. The App automatically databases 
each item that is distributed, which results in an automated numbering of distributions. 
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ThE means that when creating an IOI, the new report will be sequentially numbered, 
building on previous distributions. When analysts are generating an update for an IOI, 
they only have to make sure that they are updating the correct string (incident) and the 
App will automatically ensure that it is correctly numbered. 

Analysts are responsible for: 

• Generating a subject line that summarizes the main points of the article in a clear 
and concise manner and entering it in the proper field 

• Selecting the correlating category(ies) 

• Selecting the most specific location possible from the drop down menu 

• Pulling relevant points from multiple social media sources and generating a 
concise summary in the text field 

• Identifying the social media sources and entering them in the proper field 

o Utilizing links to Twitter postings that were distributed by media outlets, 
agencies and organizations 

o The text of a Twitter posting made by an individual may be utilized once 
any PII has been removed. The analyst must use the exact text of the 
Tweet, and then add a time-stamp indicating the date and time the posting 
was made 

• Copying and pasting the source li nk s/social media postings into the correct field 

• Selecting the method used to find the article (Sourcing) 

• Inserting tags (keywords) 

• Selecting the correct distribution list(s) (Default, LIMDIS, SPECDIS, SN Only) 

• Proofing the entire report 

• Verifying that the format is correct 

• Ensuring that no PII is included except when authorized by the approved NOC 
MMC PIA dated Jan 6, 2011 

• Verifying it is operationally relevant and compliant with the Media Monitoring 
Guidance Reminder memo (Appendix B) 
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Figure 7: MMC App - Social Media 


4.2.4.0utlook - IOI (Social Media) 

If the App is unavailable, analysts can generate an IOI via Microsoft Outlook using the 
following process: 

• Open a new message hi the Outlook program 

• Insert the format text into the message or type layout. An easy way to get the 
format is to copy it from a previous IOI 

• Generate a subject line that reflects the main points of the incident. When 
applicable, include a location 

• Add the location of the incident. Ensure this is the actual incident site and not the 
location of the journalist or news source 

• Insert the report text in bullet format 

• Insert the sources and links according to the same rules as previously discussed 
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Untitled - Message (HTML) _ o x 
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Figure 8: SN IOI - Outlook Format 


4.2.5.Application - IOI (Uploading Images) 

A valuable resource in shaping the operational picture of the DHS NOC and senior level 
staff is the use of photographs of an event or incident. Analysts can easily upload pictures 
from Social Media and Traditional Media sources to add an extra layer of operationally 
valuable information to a report. 


Utilize the following procedure to upload photographs to IOIs in the MMC 

Application: 

1) Right click on the photo that you would like to use and select “Save Image As”. You 
will need to save the photograph on one of the office shared drives in order to access 
it for upload to the App. Use the naming convention XXYYZZ-File-Name.jpg when 
saving photos for use in reports. Example: 121910-Iowa-Road-Closures.jpg. 

a. MMC Shared Drive address: (see account information sheet) 

b. SN Shared Drive address: (see account information sheet) 

2) In the report page on the Application, click on the picture icon above the report text 
box. 
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Figure 9: Adding Images To IOI 

3) When the “Image Properties” window appeals, select the “Upload” tab at the top. 



Figure 10: Adding Images To IOI 2 
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4) Click on the “Browse” button. 




Figure 11: Adding Images To IOI 3 

5) After selecting “Browse”, a window will open, allowing you to locate the file in 
which you saved the photograph (see account information sheet for shared drive 
information). Find and select the file, and then click “Open” 
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Figure 12: Adding Image to IOI 4 


6) Select “Send it to the Server” 



Figure 13: Adding Images To IOI 5 
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7) Once you select “Send it to the Server”, your image will appear in a small preview 
box. Set the width to 400 and select “OK”. 



Figure 14: Adding Images To IOI 6 

8) The image will then appeal in the report’s text box. Ensure that an Additional 
Information: heading is added above the photograph, as well as a brief caption 
identifying the image. Example: Image 1: Waves From Hurricane Fred Breaking On 
A Beach In Florida 
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Report Thread; 


Figure 15: Adding Images To IOI 7 
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4.2.6.IOI Distribution Lists 

There are different types of distribution lists that the MMC uses. Each one addresses a 
particular group, depending on the severity of the event. The following is a catalog of the 
different lists and the purpose of each. 

1) Default - this is a Full Distribution (FULLDIS) List, with more than just NOC 
personnel listed, that is primarily used for IOIs pertaining to terror 
attacks/terrorism stories, border/immigration issues, natural disasters, wildfires, 
floods, drugs/drug violence, mass killings/shootings, domestic oil spills, health 
concerns, etc. 

2) LIMDIS - this is a Limited Distribution List that consists primarily of certain 
DHS, NOC, and MMC Leadership. IOIs that are sent utilizing the LIMDIS list 
are major traffic disruptions, suspicious package/powder incidents, hazmat, and 
school lockdowns, when it is not clear that the threat is real (e.g.: a forgotten 
backpack). 

3) SN-Only - this is reserved for the SN team and includes specific members of the 
DHS Privacy office, so that they verify MMC complies with the spirit and intent 
of the PIA, especially when monitoring Social Media 

4) SPECDIS - this is a Special Distribution List, which is detennined by the 
Leadership and is used in rare cases, unusual events, or for certain individuals, 
and only when directed. 

5) Test - this is used for training and test purposes. 


4.3. DHS National Operations Center (NOC) Phases of Reporting 

4.3.1. NOC Notes 

NOC Notes are produced by the NOC whenever there is a situation that could potentially require 
federal assets such as personnel, equipment, or funding. In such cases, this would be an ongoing 
event, and NOC-assigned numbers will be used for labeling and monitoring the situation (MMC 
will receive notice via blast call, email, or pager). These IOIs have higher precedence over 
regular IOIs, but could either develop into an Awareness or become resolved rather quickly. 
These do not get added to the COP (only Monitored, Awareness, and Phase reports), but the 
MMC will continue to publish IOIs on the event until the NOC detennines that the situation has 
been resolved. 

4.3.2. Monitored 

The Monitored status is given to NOC reports which require NOC attention, but could be 
considered routine and do not rise to the level of an Awareness report. Suspicious activities, 
devices, packages, unsubstantiated bomb threats, and other incidents currently being assessed 
and addressed by Federal, State, or local authorities will normally be tracked under the 
Monitored status. 

4.3.3. Awareness 
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Awareness reports are those that have a higher precedence over general IOIs, NOC Notes, or 
events with Monitored status (many Awareness reports are a result of a NOC Note), but the 
reporting requirement has not been increased to the point of Phase reports. Each of these covers 
a singular event that could be upgraded to a Phase item as the situation evolves or escalates. 
Awareness reports are generated for National and International events that may be of interest to 
DHS and are usually handled at the local and State level. The incidents usually require only DHS 
situational awareness, monitoring, and routine reporting. NSSE or SEAR Level 1 or 2 events 
whose public safety nexus, threat, complexity, or other attributes require Federal information¬ 
sharing and Federal operations coordination and planning activities without a specific threat. 

4.3.4. Phase 1 - Guarded 

Phase 1 reports focus on manmade events, natural disasters, and other incidents that State and 
local officials will manage with the limited federal assistance of one or more DHS Components. 
Suspicious activities, events, incidents or accidents that could become a matter of interest at the 
National level or events with a significant impact on Federal Tier 1 critical infrastructure would 
also fall under Phase 1 reporting. Phase 1 reporting would also be initiated for events that have a 
homeland security or public safety nexus that the National Security Staff, Secretary, and/or 
senior DHS officials may need to address. 

4.3.5. Phase 2 - Concern 

Phase 2 reports cover any event that meets one or more of the four criteria outlined in Homeland 
Security Presidential Directive - 5. 

1. A federal department or agency acting under its own authority has requested the 
assistance of the Secretary. 

2. The resources of state and local authorities are overwhelmed and federal assistance has 
been requested by the appropriate state and local authorities. 

3. More than one federal department or agency has become substantially involved in 
responding to the incident. 

4. The Secretary has been directed to assume responsibility for managing the domestic 
incident by the President. 

Incidents that require Phase 2 reporting include manmade events and natural disasters causing 
loss of life or industrial accidents occurring in densely populated areas with potential public 
safety or public health impacts. Credible threats with a known time, location, and method as 
detennined by the intelligence or law enforcement community characterized by 
possible/confirmed terror nexus with U.S. homeland security implications would also be reported 
under Phase 2. An event or incident requiring a coordinated federal response in which two or 
more DHS Components are substantially involved would also fall under Phase 2 reporting. 

4.3.6. Phase 3 - Urgent 

Phase 3 reporting is characterized by an event so catastrophic that the federal government must 
assume the highest level of operational posturing and activity. 

4.3.7. Events of High Media Interest or International Significance 

Periodically, there are events that the NOC constantly monitors - both national and international 
- and are listed on the NOC Priorities and Monitoring Report. The MMC will monitor such 
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events to see if an IOI is warranted. Usually these events will be included in the OPSUM even 
though they may not have a NOC number assigned, and in this case, would simply be used to 
enhance situational awareness. Some of these events may be issued a NOC-assigned number 
and in this case, the MMC will publish IOIs in the same manner as it would for NOC Notes, 
Awareness, or Phase reports. These do not get added to the COP unless the NOC directs the 
MMC to do so. 

4.3.8. NOC Numbered Items 

On occasion, the NDD/SWO will determine that an incident is worth tracking; however, it may 
not be substantial enough to warrant the generation of a higher level report, such as a NOC Note, 
Awareness, or Phase Report. 

NOC Numbers may be utilized for any type of incident and usually follow the [NOC #0000-00: 
Incident Title] format. However, if an incident falls under the Public Safety or Suspicious 
Activity category, the NOC may issue an item in the [NOC #0000-00-000: Incident Title] 
format. In those cases, incidents will be issued one of the following NOC Numbers, with the 
addition of a 3-digit tracking number at the end: 

• NOC #0012-12: Suspicious Activity - Chemical, Biological, Radiological, Nuclear or 
Explosive (CBRNE): Covers any suspicious incident which may involve a CBRNE or 
CBRNE threat 

• NOC #0013-12: Suspicious Activity: Covers any suspicious incident which does not 
involve a CBRNE 

• NOC #0014-12: Public Safety/Unusual Activity: Covers any incident that is not 
suspicious in nature, but needs further information or tracking 

Example: NOC 0012-12-295 [Suspicious Powder, Anchorage, AK] 


4.4. NOC Phase Reporting Via MMC Application 

While the creation process is generally the same as that for an IOI, the analyst is responsible for 
inputting the NOC number, item description, and a title that summarizes the main point of the 
update. The data-basing function built into the App automatically provides the update number as 
successive items are sent. 
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Figure 16: NOC Numbered Updates 


4.5. IOI Corrections 

Collection notices are issued in the event that incorrect information is distributed in an IOI. The 
magnitude of misinformation can range from a misspelled word to a missing link. Whenever the 
analyst finds a mistake in a distribution after the item is sent, the first step the analyst will take is 
to notify the MMC Watch Lead, and if necessary, contact the MMC Program Manager to inform 
them of the mistake. 

Management will review the severity of the mistake and determine whether a collection notice 
will be issued. Under no circumstance will the analyst send out a collection notice without 
managerial approval. If an IOI is numbered wrong, a collection notice usually is not issued. 
Update the log with the collect IOI number and ensure the succeeding IOI is correctly numbered. 

It should be noted that although MMC strives to send high quality work, mistakes at times do 
occur. Taking time to thoroughly review an IOI prior to distribution and maintaining a high 
degree of attention to detail will keep mistakes to a minimum. When a collection notice is 
required, the analyst will draft a brief summary detailing the error and providing collected 
information. This summary will be bold and placed at the top of the IOI, before the rest of the 
report. The word CORRECTION: will also be placed at the beginning of the IOIs subject line. 

Sample Subject Live: CORRECTION: NOC 1196-10 [H1N1 Flu - United States] MMC 
Update #709—Pennsylvania Confirms 125 Total H1N1 Flu Cases” 


41 



























I sop 


Sample Correction Summary: CORRECTION: The total number of deaths provided in 
the subject line for this IOI was incorrect. Pennsylvania has confirmed 125 total flu 
cases, not 125 total flu deaths. The information has been corrected in this notice. 


^fayiaifa. 


~ CORRECTION: NOC 0926 11 [Hurricane Irene - Atlantic OceanJ MMC 

Subject line should now read: "CORRECTION: NOC 0926-11 
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[Hurricane Irene - Atlantic Ocean] MMC Update #114—Tornado 
Reported In New Castle County, Airport Damaged - Delaware" 


CORRFCnON NOC 0936.11 [Hurricane liene - Atlantic Ocean] MMC Updatr Al 14-Tornado Repotted tn New Castle County, Airport Damaged - Delaware 


CORRECTION: The incident described in (his IOI occurred in 2004. Although the incident did occur, it is not a recent event. Please delete and disregard "NOC 0926 11 (Hurricane 
Irene Atlantic Ocean| MMC I prime f»l 14." It was sent Sat 2? Aug, 2011 at 6:53 PM. 


Location: Delaware 


A tornado npped through the New Castle Countv Airpoct just after 4 pm Tuesday, causing damage to s< 
of several ncarbv businesses and dcstioved one car on Route 141 near U.S. Route 13. 


No serious injuries were reported More than 11.000 Conectiv Energy customers were without power late Tuesday. 


The National Weather Service confirmed that a funnel dond touched down near the airport abi 
moving to a nearby industrial complex 

Five of the gigantic C-130 cargo planes assigned to the Delaware Air National Guard at the air 
Department of Natural Resources and Environmental Control reports 15.000 gallons of aviatioi 

The United Electric Supply Company, across from the airport, also sustained heavy damage fit 

Traditional Mi din Sources (some page content raav change or not be available ov er time) 

WBOC TV 

— http www wboc corn'story'2361667 tomado-rips-throu gh-noithcm-d elaware 


Operations Anahit 



planes and the airport's terminal building. The tornado also ripped the roofs off 


>wn again on the state road before 
tipped onto its wing. The Delaware 


A short, brief explanation is 
given just below the subject 
line in the body of IOI. 


Figure 17: IOI Correction 

After a collection notice is issued, it should be recorded in the daily log. The analysts 
should record the item as a normal distribution, but also include the reason that the 
correction was sent in the “Watch Notes” section. 

4.6. Operational Summary (OPSUM) 

Night shift analysts will compile a summary of items that have been distributed by the MMC 
over each 24 hour period. The Operational Summary provides a synopsis of distributed items 
based on a set of designated priorities that axe generated by the NOC. In rare circumstances, the 
NOC may requir e that Operational Summaries be generated at irregular intervals in support of 
ongoing situations. These special reports will be generated at the direction of the NOC or senior 
personnel, and will be closely coordinated with the senior reviewer before distribution. In all 
cases, the OPSUMs and Special Reports NEVER include PH except when authorized by the 
approved NOC MMC PLA dated Jan 6, 2011 

The on-duty Traditional and Social Media analysts collaborate to generate a single report and 
submit it to the designated Senior Reviewer no later than 0400. The Senior Reviewer will check 
the report for proper grammar, punctuation, content, PLA compliance, and adherence to the NOC 
Priorities. Once the Senior Reviewer has approved the Operational Summary, the on-duty 
Traditional Media Watch analyst will distribute it. 
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• One copy of the OPSUM will be sent to the NOC MMC Distribution List using the 
BCC line. 

• A second (identical) copy will be sent to: 

o WHSR (see account information sheet) in the TO Line 
o All senior reviewers and the DHS/OPS Senior Advisor in the BCC line 

• The OPSUM should be distributed as soon as it is checked by both watch analysts, after 
receipt from the Senior Reviewer, and no later than 0500 unless an early production call 
is issued by the NOC. If an early production is requested the on duty analysts are 
responsible for notifying the Senior Reviewer as soon as possible that the time 
production time has been adjusted. 

4.6.1.Operational Summary (OPSUM) Format 

The Operational Summary (OPSUM) is distributed each morning to provide recipients 
with the most current update for ongoing situations (e.g. Phases, Awareness), and events 
of high media interest. As such, the OPSUM format directly reflects the published NOC 
Priorities. Analysts will gather the most current media infonnation on active situations 
for the summary. The most current infonnation is considered infonnation not older than 
24 hours and will include information from previous IOIs in addition to scanning for new 
information and relevant updates. It is important to remember that the Operational 
Summary is used for agency briefings and must relay the most cunent information in a 
structured and easily readable format. 

Note: If there was a NOC item during the previous 24 hours that was closed out prior to 
the drafting of the morning OPSUM, it may be included if there was significant coverage 
by the MMC or heavy interest on the part of the NOC while the item was active. 

• The OPSUM is created in an Outlook email message. 

• The standardized subject line is used for the report. 

• A short summary of the topics covered in the report will also be included in a 
header for the OPSUM. 

• Analysts will utilize a header and bullet format when inputting infonnation. 

o To distinguish between Traditional and Social Media items, all Social Media 
input will be italicized. Social Media analysts will also include (Social Media) 
at the end of each bullet as an additional designator if the content under one 
priority is mixed with infonnation from Traditional Media 
o If all the bullets under a priority are from Social Media, then the (Social 
Media) tag should only be included next to that specific priority title. 

• Hyperlinks to sources will be included with the bullets for items of high interest or 
particularly significant summaries. SN analysts will include links to translated 
articles if using foreign language sources. 
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Example Operational Summary provided on the following pages. 


NOC MEDIA MONITORING OPERATIONAL SUMMARY (OPSUM) 

24 Hour Summary, August 16, 2011 

TODAY’S OPSUM COVERS THE FOLLOWING NOC PRIORITIES 


Single space 

between 

sections 


• NOC Priority Items with new information 

o Southwest Border Events with U.S. Homeland Security Implications 

• Other Significant Items 

o Severe Weather - KY/IN 
o A1 Qaeda Urges Attacks Against U.S. 4 
o Continued Violence in Syria 

• NOC Priority Items (Nothing Significant To Report (NSTR)) 

o Global/Commercial Aviation Cargo Threats/Incidents Targeting U.S. Interests 
o Mass Migration in the Caribbean with U.S. Homeland Secur ity Implications 
o CBRNE Threats/Incidents Targeting U.S. Interests * 


NOCM^03-11: Southwest Border Events with US Homeland Security Implications 

Killings (non U.S. persons) 

• The Mexican Army captured the suspected leader of a Beltran Leyva drug cartel who allegedly 

controlled drug trafficking in the Costa Grande region of Guerrero state and orchestrated a number of 
killings Fox News Latino 

o The suspect had taken over the Beltran Leyva cartel’s operations in the city of Zihuatanejo, 
Guerrara, after the arrest of one of his bosses, unleashing a wave of executions of rival group 
members 


Items Identified on NOC Priorities 
but not reported by MMC/SN 


Hyperlinks take reader to 
corresponding sections 


iltsyrl l 


1 rls>nth 


■vU 


• Three separate grenade attacks in Mexican cities over the weekend haypi 
injuries (Social Media) Milenio News [Translated by Gooslel 

o The attacks occurred at a prison in Apodaca, Nuevo Leon; on a busy tourist boulevard in 
Veracruz; and at a movie theater in Reynosa (Social Media) 

• The director of the Ixtlahuacan del Rio Police was executed on Saturday night in an ambulance in the 
municipality of Cuquio (Social Media) Guerra Contra El Narco [Translated by Gooslel 

o Medical staff confirmed that the vehicle was intercepted by an unknown number of 

individuals on the Rio-Cuquio Ixtlahuacan highway at San Juan del Monte (Social Medit 4— 
o The murderers beat emergency medical technicians after the execution and fled (Social 
Media) 

Other Impacts of Southwest Border Violence (SWBV) 

• As part of the Central American Law Enforcement Exchange, law enforcement officers from Latin 
America are training with local police in Los Angeles on combating international gang crimes, 
especially narcotics trafficking, kidnapping and human trafficking 

o The Exchange features a week-long training class made up of about 30 officers from the 
U.S., El Salvador, Panama, Costa Rica, Honduras and other countries, 
o FBI Officials said Los Angeles stands to benefit from the collaboration because there are up 

7,000 members. 


[Back to topi 



Link takes reader back to 


top of report 


Sources 
Included for 
bullets with 
more 
significant 
information 


(Social Media) designates 
contributions from SN Sources. 
NOT BOLD 


Figure 18: OPSUM 
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OTHER SIGNIFICANT EVENTS: 

Severe Weather—Kentucky / Indiana (Social Media) Twitter [WA VE 3 NeM’sl 

• As of 3:00 a.m. [16 Aug] local time, LG & E's outage map was reporting less than 12,000 customers 
without power in Jefferson County, down from a peak of over 128,000 Saturday night 

o LG & E hopes to have a majority of customers back up and running Monday and Tuesday, and 
the remaining by Wednesday 

o The Jefferson County Public School system cancelled all classes on Monday due to power 
outages in the area 

• Duke Energy’ reports 1,516 outages remaining across 5 Indiana counties 

New A1 Qaeda Leader Urges Attacks on the U.S. Fox News (AP) 

• In a video posted on militant websites Sunday, A1 Qaeda’s new leader called on followers to avenge the 
killing of Osama bin Laden and to continue the Islamist jihad against America 

o The leader also stated that uprisings in Egypt and Tunisia have presented A1 Qaeda with 
opportunities to spread its message throughout the Arab world 

o A1 Qaeda has tried to forge a role for itself in the recent uprisings though it has little in common 
with the mainly youth activists behind the protests.... most uprising leaders say they seek 
greater freedoms, not Islamic states 

Continued Violence in Syria Reuters 

• Syrian forces shelled residential districts in Latakia on Monday, the third day of an assault on Sunni 
neighborhoods of the port city 

o Approximately 35 people, and possibly more, have been killed in the city since the assault on 

Latakia began on Saturday, activists and witnesses say (Social Media) 

• More than 5,000 Palestinian refugees have fled a camp in Latakia (Social Media) 

o It was not immediately clear where the refugees were seeking shelter (Social Media) 

o A UN spokesman reports that "there were 10,000 refugees in the camp"prior to the attack 
(Social Media) 

• Separately, troops conducted raids and arrests in the village of Houla 

• UN authorities cite reports that Syrian security’ forces have opened fire on defectors within their own 
ranks and executed troops that refused orders to kill civilians (Social Media) 

o "There are indications that more than 300 security’ forces or army personnel have died, in 

circumstances that remain to be elucidated, but could include clashes with armed opposition as 
well as internal executions of defecting soldiers," officials said (Social Media) 

I Back to ton! 


Analyst’s Name 
Operations Analyst 
DHS NOC Media Monitoring 
Phone: 555-555-5551 
Cell: 555-555-5552 


Figure 19: OPSUM continued 


5. Homeland Security Information Network (HSIN) 
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The Homeland Security Information Network (HSIN) is a national secure and trusted web-based 
portal for infonnation sharing and collaboration between federal, state, local, tribal, territorial, 
private sector, and international partners engaged in the Homeland Security mission. 

HSIN is made up of a growing network of communities (portals), called Communities of Interest 
(COI). COIs are organized by state organizations, federal organizations, or mission areas such as 
emergency management, law enforcement, critical sectors, and intelligence. Users can securely 
share within their communities or reach out to other communities as needed. HSIN provides 
secure, real-time collaboration tools, including a virtual meeting space, instant messaging and 
document sharing. HSIN allows partners to work together instantly, regardless of their location, 
to communicate, collaborate, and coordinate. 

MMC analysts are provided access to the HSIN Government Home, NOC, Emergency 
Management and Fed Ops portals (COI). 


5.1. The Common Operational Picture (COP 3.1) 

The Common Operational Picture is a database used by NOC personnel and Emergency 
Operations Centers to easily view updated information on incidents being monitored by DHS. 
The COP serves as a single location in which all of the infonnation regarding actively tracked 
incidents of significance (Monitored or higher) is collected. 

The Media Monitoring Interface can be accessed using Internet Explorer or Mozilla Firefox. The 
following is the URL for the login screen: 


(b) (7)(C), (b) (7)(E) 


An alternate method is to access the Executive View via HSIN and then select “COP Operator 
Applications.” This should bring you to the same log in screen as the URL detailed above. 

A primary responsibility of the MMC is to update the COP with reports (IOIs) sent out on 
Monitored or higher items. After the Watch Analyst distributes a new IOI for an event being 
tracked under a NOC-assigned number, he/she will add that report to the COP. The following 
paragraphs outline the instructions for completing this task. 

5.1.1. MMC COP Operations 

The MMC monitors the COP 24/7 and is aware of any incidents the NOC is monitoring. They 
are in constant communication with the NOC and are postured to provide additional content 
related to the incident in the form of file copies of distributed Items of Interest (IOI) and/or 
associated image files. The location of this additional content is the “View Reports Tab” of the 
specific incident Overview window. This process shall be in effect for all incidents from 
Monitored through Phase III. For this purpose, MMC Analysts will be accorded KMO 
privileges. The procedure below is to be followed: 


1. Maintain liaison with the NOC and monitor the COP for new incidents 
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2. When new (Monitored or higher) events are generated, provide additional content in the form 
of Attachments (see Figure 20) to the Incident based on related IOIs (IOI message saved as 
file type MHT). If applicable, this shall include the IOI that precipitated the NOC’s actions 



DHS COP 


Incident Tools Reporting Tools Messages UserSetongs Admin^ Hein RFI 

0 Active Incidents I0| Create Incident Update Incident Manage Image^S" Manage Attachments 


Act-ve Incidents 


Title ; Phase | Priority 






Flooding WV, OH, and KY 

t Virginia 
wareness 
0351-12 


Incident/Event 




Road Aenal Bird's eye Streetside I « 


r T Layers O Query C Conus A" Fim 



Figure 20: COP 3.1 


3. 

4. 

5. 


Continue adding appropriate related material until the incident is archived 

Sign into COP using HSIN credentials (Internet Explorer only; if a dialogue pops up asking 

if you want to display mixed media, click yes) 

File attaclnnent process 

5.1. After distributing an IOI (Monitored or higher) save it as file type “milt.” Save it to the 


(b) 7 C , (b) 7 E 


Right 


MMC Shared drive: 
click, save as, and use the following format for the filename: 

MMC Report - Descriptive subj line (analyst’s subj line) - Date - Time (5Marl2 - 
1504EDT) e.g. MMC Report - Flood Waters Breach Fargo Dikes - 15Marl2 - 1504EDT 

5.2. Select COP Incident Tools - Manage Attachment Menu option 

5.3. Highlight Incident - Select OK (see Figure 21) 
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Figure 21: COP 3.1 Continued 


5.4. Select Add New and navigate to your saved IOI or image file (see Figure 22). Double 
click or highlight and select Open 
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5.5. Save Changes then close out of “Incident Attachment Management” box and verify file 
is correctly loaded and available in the Overview Window View Reports Tab (click on 
the Incident title on the left, then look on the bottom right for the View Reports tab - see 
Figure 23). 

View Reports 0 X i 

Flooding - WV, OH, and KY : 0351-12 : Awareness 

Initial Incident Report 

D351-12 Flood'i-.g WV, OH anci K< West Virginia Initial Irtcide 

Update Reports 

No Incident Update Reports available 

Senior Leadership Brief 

No Senior Leadership Briefs available 

SPOTREP 

No SPOTREP Reports available 

SITREP 

No SITREP Reports available 

Incident Attachments 



View Reports 


5.2. 


(b)(7)(A). (b)(7)(E)| 


Communicator 


I isatextoased communications tool utilized by the D epartme nt of Homeland Security to 

1 • • 1 4 4 ■ « rr*4 s rs r • ICTMYjfclOlffi 


epartme 

connect individuals at different locations. The MMC utilizes UHH as a means to communicate 
with members of the NOC Watch thr oughout the shift. The NOC has a dedicated chat room, 
identified as NOC Watch in which all members of the NOC Watch team can post information 
regarding ongoing incidents. MMC analysts will use|^m to pass information on rapidly 
evolving situations, request information and communicate directly with the SWO, KMO, or 
NDD. 


5.2.1 


yrauiyiuj! 

; loaaec 


Set-lp 


Once logged into HSIN, click on the! 


downl oad box on the right side of the 

frill client download, you will 


Emergency Management Portal. After selecting the Hyi 

be provided with the |||j||||| EXE file. Once the download is complete, follow each of the 
instructions given by the prompt windows until the installation process is complete. 
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After the file is installed, analysts will need to adjust the p rogram’s configuration 
settings. When the login screen for theb0UiICuA01IiIg| comes up. there are a couple 
settings that need to be entered into the login screen to set up the connection. This 
information includes the domain you will be connecting to, your login credentials, and 
the port that will be used for the connection. Any variants in this information could result 
in a user having issues connecting to the necessary servers. 


The initial login screen prompts the user for fairly basic information. This information 
includes a username, password, domain, and also asks if you want to use an existing 
account or create a new one. The ability to create a new account is not functional in this 


release of the 


(b) (7)(A), (b) (7)(E) 


software, resulting in an error message when users 
attempt to do this. The rest of the inf ormation, with exception of Resource, is mandatory 
to successfully log into HSENI 


The username and password are specific to each individual user that is going to be 
logging into the client software. However, the domain information is going to consistent 
for all users. The domain that needs to be supplied is “hsin.gov”. Once this information 
has been entered, it allows the user to save his/her password, though this is not suggested 
for security reasons. 



Figure 24: 


(b) (7)(C), (b) (7)(E) 


The second screen for the user login requires that the use r' ente r the hostname which 


should '. the port which should he||fj|". and the connection type 

to establish (“select the checkbox that reads “Use a secure connection”). Note, after 
entering porljjjj|j& and se lectin g the check box, the port number may change, and you will 
need to change it back tcjj|||| again and then click next. These settings will remain 
consistent for all the users accessing j 
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After clicking on Next, the following screen will appear and you must select “Accept for 
all sessions.” 


? Invalid SSL Certificate 


2 


5SL Warning! 

The server has sent you an invalid certificate, 


Accept for this session only 

Accept for all sessions 

Reject this certificate 



Figure 26 : 


(b) (7)(C), (b) (7)(E) 
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5.2.2. NOCWatch 

The NOC Watch chat room provides a centralized location for all NOC personnel to 
share infonnation during watch shifts. Analysts should always be logged into the 
NOC Watch room when standing shift, or working Project Time shifts. 

5.2.3. NOCTraining 

The NOCTraining chat room provides a centralized location for all NOC personnel to 
share infonnation on training scenarios presented during watch shifts. Analysts should 
always be logged into the NOC_ Training chat room when standing shift, or working 
project time shifts. The NOC usually generates one training incident per shift, and MMC 
personnel are required to respond to training postings/requests for infonnation. (Detailed 
information on responses for NOC Training postings can be found in the Training 
Section) 

5.3. Posting Documents/ Videos to HSIN 

The MMC will occasionally be called upon to generate special reports or video summaries of 
incidents. Once a file is created, the MMC has several options for distribution. It can be 
uploaded to HSIN and pointed to via a link on the COP Media Monitoring Interface or within an 
e-mail. 

1) Name media file using the following method: 

• The agency posting the file 

• The organization within that agency 

• The location from which the file is being posted 

• The date group identifying when the file is posted 

• The time group identifying when the document was produced (local time to include 

time zone designation) 

• Any special identifiers that the organization might use (optional) 

• File type (SITREP, SPOTREP, IAP, Incident Report, GIS product) 

• Any number identifiers for the document that the organization might use 

(optional) Do Not Use the # Character, or Any Special Characters. 

• Example - 

DHS_ICE_Charleston_SC_20070627_1500EST_DSAT_EX_Rptl then 
...2...3...4...etc 

2) Access HSIN 

• Select the HSIN government home portal 

• Select the documents tab at the top of the page 

• Locate and select the MULTI MEDIA CENTER folder 

3) Select UPLOAD NEW DOCUMENT 

• Upload the file from the analyst’s PC 

• Fill out the required fields 

4) Select SUBMIT 

• Verify that the file is now uploaded to HSIN 
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6. Watch Resources 

The Watch Resources section of this manual provides a collection of different lists, including: 
contact information for the NOC and Senior MMC personnel; tool utilities; keywords; sources 
and reporting parameters. 

6.1. Contact Information 

6.1.1.The SWO/KMO 


i i 



6.1.2. HSIN Help Desk 


HSIN Help Desk: 

'XC),(b)(6 

(b) (7)(A), (b) (7)(E), (b) (6) 



■ 

M 


6.1.3. Senior Reviewers 

See MMC roster 

6.2. MMC Tools 

All of the tools utilized by the Traditional and Social Media teams are highly effective 
resources for locating salient information on breaking or evolving situations of interests 
to the DHS NOC. While these tools are all established in a standardized maimer, it 
becomes necessary as situations develop, to add, edit or adjust the search and source 
parameters that are used. When necessaiy, the protocol below will be followed for adding 
search terms or sources to MMC tools: 

4. The Watch analyst will identify the source or keyword that he/she would like to 
utilize within MMC tools or general internet browser searches and submit it to the 
Watch Lead (Senior Analysts on shift). 

5. The Watch Lead will approve or disapprove of the keyword term or source. If the 
Watch Lead believes that the source or keyword will add value or provide greater 
granularity to established searches, the item will be added to MMC tools/searches. 

6. A note regarding the addition of a new keyword or source will be entered into the 
MMC’s Daily Log, and an email identifying the change will be sent to MMC 
management. The new keyword term or source will also be provided to oncoming 
analysts during the next shift changeover brief. 


6.3. Traditional Media Tools 
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6.3.1. Moreover 

MoreOver NewsDesk, or simply MoreOver, is an international media monitoring 
service. MoreOver monitors and analyzes hundreds of thousands of online global 
sources for keywords of relevance to its customers. To access this service one must 
have a User ID and Password. Notice that search terms are stored on the left side 
under “Content”. 

Note: Within each search, there is an array of words that can be grouped in order for 
MoreOver to perform a more detailed search (for example, keyword “Hazmat” also 
contains “chemical spill”). 

MoreOver can find information on a particular search term and retrieve thousands of 
news articles within seconds. This allows the MMC to have near real-time access to 
information. The “Search” function allows analysts to create and save searches as 
needed. Once a search is created, it will appear in the user’s “My Content” folder, and 
can then be shared (by dragging and dropping) to either the “MMC Content” or “SN 
Content” folders. The ability to generate individual searches provides analysts with 
the capability to create, save, and manage news searches on-the-fly as operational 
requirements change and evolve (e.g.; suspicious package, train derailment, bomb 
threat, or chemical spill). MoreOver also graphically displays the number of articles 
found within a single hour, day, week, month, and even longer. MoreOver’s key 
word searches incorporate wildcards and Boolean operators like “and”, “or” and 
or various concatenations (e.g., A and B but not C). These operators are helpful in 
narrowing a user’s search and result in more relevant and timely information. Search 
parameters help limit the amount of information analysts must deal with on any given 
day. 
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Figure 27: MoreOver NewsDesk 

A linritation to the MoreOver is that the team only has two accounts for analysts. If 
the analyst on shift is using the program, back-up accounts will have to be used. 


6.3.2. 


RSS Owl 
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RSS Owl is a news aggregator for RSS and Atom News feeds that utilizes user 
generated subscriptions and search criteria to sort, organize and present information 
from multiple sources in an easily read format. RSS Owl also provides a keyword 
search function, allowing users to search all of the sources that have been input at one 
time. 

http://www.rssowl.org/ 
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BBC News (58) 

Q CNN (10) 

fp Guardian Unlimited (14) 

S New York Times (1) 

1 Reuters News (10) 

Google News (10) 
a Engadget (40) 


Title 

Date 

Author 

Category 

- 

a US vets. Japanese mark anniversary of Iwo Jima 

Of 9:34 AM 



ra 

I Magnitude 61 quake jolts eastern Japan, no tsunami warning 

©? 9:33 AM 



ii'i 

iia Oil rises above S107 amid improving US economy 

Ilia Hundreds prepare to run in Egypt presidential vote 
la Strong quakes shake Japan, but no apparent damage 

Ha Oil falls to near $106 after US crude supply jump 
a Jobless rate at record high, budget looms 

OF 9:33 AM 

Of 9:32 AM 

OF 9:32 AM 

OF 9:31 AM 

OF 9:31 AM 



jij* 

l|# 

r. 

Magnitude 6.1 quake jolts eastern Japan, no tsunami warning 
# ill* te 1 | 9:33 AM 




X 

TOKYO (Reuters) - An earthquake with a preliminary magnitude of 6.1 hit east of Tokyo on Wednesday but no tsunami warning was issued and there 
were no initial reports of damage or troubles at area nuclear plants, the Japan Meteorological Agency and local media said. High-speed bullet trains 
serving northern Japan were halted and the two runways at Tokyo's Narita International Airport were closed after the quake but quickly resumed 
operations, local media reported. No abnormalities were reported at the Tokai No. ... 

□ Menu i 1 Related News i Full Content 






Figure 28: RSS Owl 


6.3.3. FeedDemon 

FeedDemon is an RSS news aggregator that utilizes user generated subscriptions and 
search criteria to sort, organize and present information from multiple sources in an 
easily read format. FeedDemon also provides a keyword search function, allowing 
users to search all of the subscriptions that they have uploaded at one time, as well as 
watch folders, that allow the user to sort items into distinct categories based on key 
words. 
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Figure 29: FeedDemon 


6.3.4. Broadcastify 

Broadcastify is an open source aggregator of public safety, aircraft, rail, and marine 
radio live audio streams. It utilizes broadcast feeds from multiple sources, including 
public safety agencies. Broadcastify allows users to search broadcast feeds based on 
location. This allows the user to narrow in on a location once an incident occurs. 
http://www.broadcastify.com/listen/ 



Figure 30: Broadcastify 

6.3.5. Camtasia Video Processing 

Video Processing involves evaluating, clipping, cropping, editing, and merging 
source data fdes. The objective of the MMC is to capture, evaluate, and process the 
file(s) as quickly as possible to ensure information gets to decision makers in a timely 
manner. It is not necessary to produce exceptionally detailed products, just ones 
where the key elements are quickly grasped and add to the SA available from the 
COP. 
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Figure 31: Camtasia Studio Video Processing 

If a source file is not available, the MMC must “capture” or copy the video in 
order to generate video summaries of incidents of interest to the NOC. Camtasia 
Studio is the tool currently used by the MMC to capture video. The application 
allows analysts to capture still pictures and video products, as well as edit and 
produce videos. The program allows files to be stored in its own proprietary 
format, which is only readable by Camtasia itself; this fonnat allows for fairly 
small file sizes, even for longer presentations. Camtasia also allows the user to 
generate a video stream that can be exported to common video formats that can be 
read by most computers, even if the Camtasia software is not installed, such as 
MPEG-2 or MPEG-4. 

Creating the final product also entails adding textual description and attribution. 
As a lead-in to the video the following information is displayed: 


First Lead Frame 

DHSNOC 

Media Monitoring Capability 

IOI#_, orNSS_ 

Title 


Second Lead Frame 

Location 

Date 
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Time Reported 


Ending Frame 

Attrib utes/ Sources 

6.4. Social Media Tools 

6.4.1. Twitter 

Twitter is an online social networking service and microblogging service that enables 
its users to send and read text-based posts of up to 140 characters, known as "tweets". 
Tweets are publicly visible by default; however, senders can restrict message delivery 
to just their followers. Users can tweet via the Twitter website, compatible external 
applications (such as for smart phones), or by Short Message Service (SMS) available 
in certain countries. 

The MMC team utilizes Twitter as one of a number of tools in which to locate 
information on breaking or evolving incidents. The use of keywords or the 
combination of keywords through Boolean Logic is an effective means of locating 
postings on DHS relevant topics. When a Twitter posting is found, analysts may need 
to view the profile of a user to identify whether or not the username is PII. This is the 
only reason an analyst should click on a user profile. If the posting was generated by 
a media outlet, agency or organization, a link to the actual tweet can be used as the 
source. If an analyst determines that the posting was made by an individual and not an 
organization or media outlet, the text of the tweet may still be used. However, rules 
for the removal of PII from generated reports must be followed. Other than removing 
PII, the text of a tweet that is utilized in a report will not be modified in any way. 

While it is not necessary to establish an account with Twitter in order to view 
postings by other users, the MMC has established the account in 

order to utilize other Twitter-based visualization and analysis tools. It is important to 
note: 

1. The MMC does not follow the accounts of individuals unless they are within 
the seven authorized categories of individuals (e.g., a government official 
acting in their official capacity). 

2. The MMC does not post messages (Tweets) to its Twitter account. 

3. The MMC does not post messages to other users ’ accounts in order to elicit a 
response. 

4. The MMC does not accept follow requests from other Twitter users. 

5. Periodic reviews of the MMC’s Twitter accoun t are carried out by 
management in order to ensure that no postings have been made, and that the 
accounts ofprivate citizens are not being followed. 

6.4.1.1. Adding Twitter Accounts to “Follow” 
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Under no circumstances will MMC analysts “follow” the Twitter profiles of private 
citizens. However, in the course of conducting NOC/MMC business, MMC analysts 
may determine that a new Twitter profile needs to be added to the approved list of 
accounts that are followed. When additions are necessary, analysts will adhere to the 
process below for “following” an account: 


1. The on-shift analysts agree that a Twitter profile should be added to the 
Twitter Profiles Followed list due to changing circumstances and NOC 
requirements. 

2. The MMC Watch Lead approves the request and sends an email or 
request to the on-duty NOC SWO/ASWO for approval. 

3. NOC SWO/ASWO approves the request in an email or Jabber response back 
to the MMC analysts. 


(*>) CXA)l CD) ( 


6.4.2. Tweet Deck 


Tweet Deck is a desktop application for Twitter, Facebook, Linkedln, Google Buzz, 
Foursquare and MySpace. It interfaces with the Twitter API to view tweets. Users can 
split the program into different columns, allowing items to be sorted by topic. 


httt>://www.tweetdeck.com/ 
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Figure 32: TweetDeck 
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6.4.3. Shrook 

Shrook is an RSS reader that utilizes user generated subscriptions and search criteria 
to sort, organize and present information from multiple sources in an easily read 
format. Shrook also provides a keyword search function, allowing users to search all 
of the subscriptions that they have uploaded at one time. 

http://wvvw.utsue.com/shiook/ 
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Figure 33: Shrook 


6.4.4. RSS Owl 

RSSOwl is a news aggregator for RSS and Atom News feeds that utilizes user 
generated subscriptions and search criteria to sort, organize and present information 
from multiple sources in an easily read format. RSS Owl also provides a keyword 
search function, allowing users to search all of the subscriptions that they have 
uploaded at one time. 

http://www.rssowl.org/ 

6.4.5. Speed Dial 

Speed Dial is an organizational tool that allows users to add a number of websites 
within a grid structure, making it easy to quickly access frequently used web pages. 
This program essentially provides a graphic representation of the user’s bookmarks. 
http://speeddial.uworks.net/ 



Figure 34: Speed Dial 


6.5. Account Information 

For security reasons, MMC account information is maintained within the watch center, 
(see account infonnation sheet) 

6.6. Personally Identifiable Information (PII) 
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PII refers to information that can be used to uniquely identify, contact, or locate a single 
person or can be used with other sources to uniquely identify a single individual. Before 
distributing reports, including IOIs, MMC and SN analysts must first identify and 
carefully consider any PII information in media sources before making a decision on 
whether to preserve such information in distributed reports. In most cases, analysts are 
required to remove PII in the interest of protecting personal privacy. In a limited number 
of cases, however, in accordance with the approved NOC MMC PIA dated Jan 6, 2011, 
analysts are authorized to include PII in a distributed report. Guidance on when and how 
make such detenninations on PII is addressed in the following paragraphs and is based on 
the current PIA which is the final authority. 

In most circumstances, analysts will not report PII for private citizens (i.e., people who 
are not prominent government officials or news media personalities, regardless of 
whether they are witnesses, victims, observers or in some other way connected to an 
event covered in an IOI or other report product. There are, however, rare “in extremis 
situations” when it may be pennissible to use PII for private citizens. An in extremis 
situation occurs when there’s an imminent threat of loss of life, serious bodily hann, or 
damage/destruction to critical facilities or equipment. In these circumstances, the 
appropriate DHS OPS authority must approve PII, in which case MMC management 
would need to be made aware of the situation. (DHS OPS authority includes OPS Senior 
Executives and the SWO.) 

Generally, PII for public officials or spokespersons may be reported when it adds value 
and lends credibility to a report or facilitates coordination with federal, state, local, tribal, 
territorial, foreign, or international government partners. The MMC will not report on 
high-profile people such as celebrities, sports figures or media members who are victims 
unless they are current or former public officials. Lastly, it is important to note that the 
MMC must never report on individuals suspected or accused of committing crimes of 
national or homeland security interest if captured (unless they are killed or found dead). 

In accordance with the NOC MMC PIA dated Jan 6, 2011, PII is authorized in reports 
for: 

1) U.S. and foreign individuals in extremis situations involving potential life or death 
circumstances; 

2) Senior U.S. and foreign government officials who make public statements or 
provide public updates; 

3) U.S. and foreign government spokespersons who make public statements or 
provide public updates; 

4) U.S. and foreign private sector officials and spokespersons who make public 
statements or provide public updates; 

5) Names of anchors, newscasters, or on-scene reporters who are known or 
identified as reporters in their post or article or who use traditional and/or social 
media in real time to keep their audience situationally aware and infonned; 

6) Current and former public officials who are victims of incidents or activities 
related to Homeland Security; and 
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7) Terrorists, drug cartel leaders or other persons known to have been involved in 
major crimes of homeland security interest (e.g., mass shooters such as those at 
Virginia Tech or Ft. Hood) who are killed or found dead. 

PII in these cases may include: names; affiliations; positions or titles; and publicly- 
available user IDs and contact information for in extremis situations (case 1) only. 

6.6.1. Privacy Impact Assessment 

o See Appendix A 

6.6.2. Quality Control 

The MMC employs a vigorous Quality Control process to ensure that PII is not 
inadvertently included in reports. IOI reports are reviewed at multiple steps 
throughout the production process, and checks are also completed after the report has 
been distributed. While a report is being generated, it is reviewed at least twice, once 
by the analyst generating the report, and then again by his/her counterpart. Every IOI 
is checked by the shift’s Watch Lead prior to distribution. All IOIs distributed during 
each 24-hour period are checked by an MMC Senior Reviewer during the production 
of the MMC’s Operational Summary. The MMC’s Quality Control leads also 
conducts a weekly review of all reports distributed to ensure that any potential PII 
inclusions missed by personnel on watch are identified and corrective action is taken. 
Privacy Compliance Reviews (PCR) are also conducted out approximately every six 
months to ensure all aspects of the MMC program are completely compliant with 
letter and spirit of the PIA. 

6.6.3. Inadvertent PII (Redaction) 

When PII is inadvertently included in an MMC distribution, there is a multi-step 
notification and redaction process that must be implemented to ensure that reports are 
corrected in accordance with the MMC PIA. 

In the event of an inadvertent PII inclusion in MMC reports (IOI, Awareness, Phase, 
OPSUM, Weekly Data Reports, etc.), the following procedure must be implemented 
to fully comply with PII guidance and rules. 

As soon as unauthorized PII has been identified, the analyst must notify MMC 
leadership who will notify the DHS/OPS NOC Director that an IOI with inadvertent 
PII included had been sent and request authorization to send an email deletion 
advisory to the full distribution list and an email to the MMC team notifying them 
that the PII must be deleted from the errant IOI. 

A second email will advise readers that unauthorized, but unclassified information 
was accidentally included in the IOI (identified by subject line and DTG) and 
therefore must be pennanently deleted. A general description of how to remove the 
PII or permanently delete the IOI in MS Outlook will be provided along with a notice 
to contact the recipients’ system administrator with questions for programs other than 
Outlook. 
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6.6.4. PII Redaction (Notification to Team) 



$ 

* 

* - 

FW: Inadvertent PJ Inclusion 

Redaction Required 

- Message (HTWL1 

^ n y 

Message 






to. 


-4 

<2jj) 1M • 

X 

dP 

^ ^Safrlirti 

■5ar j 

M Find 
-^1 Related - 

Select * 

Reply 

Reply Forward 
to All 

Call * 

Delete Move to Create 
Folder - Rule 

Other 
Actions * 

Block 

Sender 

Categonie Follow Madras 
Up- Unread 


Respond 


Action: 


lunk E-mail 

r * Options r * 

find 

From: 

* NOC Nede Mom toms 




Sent. Ved 9 12 2012 1.2:05 PM 


1(b) (7)(C), (b) (6)1 


Subject FW Inadvertent PH Inclusion - Redaction Requiied 


I 

Team, — 

PII was inadvertently included in I'PDATE Suspect In Bomb Factors House Admits To Robbing San Diego Banks , 
California—MMC 101*2695-10 2 Dec a: 0254 1 , PII was included in the : bullet Please follow the procedures 

below to remove this information from vour IOI message 

The manual deletion procedure will be included in each email directing such action The following steps must be used: 

1 Open the email message 

2 Select "Other Actions"' in the Actions' section of the toolbar at the top of the page 

3 Select " Edit Message from the Other Actions pull down menu 

4 Replace the offending PII with "xxxx. “NO Link due to PII,' whichever is directed in the email communication 

5 Close the edited email, and click yes when asked if you want to save changes 

In all cases, analyst or senior reviewer, confirmation of completion of the action must be sent to Brad witkin 24 hours 
of receipt. 


Operations Analyst 



Figure 35: PE Redaction Notice to MMC Team 
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6.6.5.PII Redaction (Notification to Full Distro) 




Figure 36: PE Redaction Notice to Full Distro 


6.7. NOC Priorities 

The National Operations Center publishes a daily NOC Priorities Report eveiy 24 horns 
to identify the priorities for each shift and help guide the information gathering activities 
of NOC personnel. This report is usually distributed via email fr om the NOC between 
2000-2300 each day. Analysts should use the priorities report to direct their reporting 
and as a guide for the generation of the Operational Summary. 
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4 DHS Sersoi Staff Requests for Info'maticri Event Support NTR 


Figure 37: NOC Priorities 


6.7.1. NOC Priorities (HSLN Retrieval) 

These instructions should be utilized as a means of retrieving the National Operations 
Center Priorities for each shift should there be a malfunction in the automated 
forwarding system. 

1) Step One: Access the Homeland Security Information Network 



Home | Seeick | Stlti | Document* 


Your Contact Card 



Organization: 

Department of Homeland Security 

Your Address Bock 

First Name 

Je*n 

Edit Your Information 

M*ddl« Initial: 

Dm 

Change Your Password 

Last Name 

View Community USt 

Email Address: 

j«*in -o» ® mmcoWce no* 


Mobile Email Address: 


Business Phone: 

Title: 

Operations Analyst 

Mob-le Phone: 

Address Name: 

Work 

Pager: 

Address Une 1: 

Address Une 2: 


Other Phone: 

C*y: 



County: 


Federal 

State: 


OHS COOP-OPS 

Postal Code: 

United States 

Emergency Management 

Country: 


First Contact Choice: 

EmaiiAddrest 


Second Contact Choice: 
Third Contact Choice: 

Business P*x>ne 

National Ooerations Center 


Figure 38: HSIN NOC Priorities Retrieval 
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2) Step Two: Select the National Operations Center Tab in the lower left 
comer. 



Other Phone: 


Your Communities 

Federal 

Emergency Management 

Federal Operations 

HSIN Government Home 
National Operations Center 

- 


Figure 39: HSIN NOC Priorities Retrieval 2 


3) Step Three: Select the Library Tab. 


inaglt 

7 ^ 

£ 


13' 


s’ Web Search |j^» P - 


$ Home - NOC 


hsin 


i | NOC Watch Desks | Library | Training | HSIN Database | COP | Support 


inal Operations Center 
louncements 

Item | ^Filter 


t 


i tie 

nteragency Threat Assessment and Coordination Group Brochure 
ISIN System Migration 

IOC Watch COOP Familiarization Tour (March 2008) 

IOC Community of Interest architecture modification 


Figure 40: HSIN NOC Priorities Retrieval 3 
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4) Step Four: Scroll down to the document library section. 




Figure 41: HSIN NOC' Priorities Retrieval 4 


5) Step Five: Select the NOC Priorities and Monitoring Reports folder: 


Document Library 

Type Name £ Modified By 

iSj DHS OPS-HSOC-NOC 5A-COP Brief 24 May 06 

aj The Evolution of HSOC Situational Awareness 03 April 2006 REV4_hurricane_version 
DHS CINT Intelligence Notes 
3 DHS Cyber Daily Reports 
□fl DHS Daily Ops Report 
ca fema National sitrep 

3 NOAA Meteorological Lpdate 
a NOC Priorities and Monitoring Reoorts 

Q Add new document 

Operations Directorate COOP Documents 


Figure 42: HSIN NOC Priorities Retrieval 5 
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6) Step Six: When the folder opens, scroll down to the Document Library 



National Operations Center 
NOC Watch Desk SOPs 

Type Name 

Crisis Action Process Operating Instructions (v.10 as of 17 Apr 07-SWS) 
g] IIMG SOP (02 23 05) 
o JFO SOP Appendix-Annexes (v55) 

0 Add new document 

Forms 

Type Name 

11000-14 Identification Access Control Card Request 
ffil 11000-25 Contract Suitability-Security Screening Request Form 
S’] 3130 DHS Non-Staff Assignment Form 

8*1 NAC Access Control - Visitor Access Form 

O NAC Access Control and Visitor Access Procedures (memo 9-26-06) 

0 Add new document 

Document Library 

Type Name £ 

NOC Priorities and Monitoring Report 5 December 2008! new 
NOC Priorities and Monitoring Report 4 December 2008 

s Add new document 


Operations Directorate COOP Documents 


Figure 43: HSIN NOC Priorities Retrieval 6 


7) Step Seven: Select the NOC Priority list for the desired date: 


Document Library 

Type Name 

NOC Priorities and Monitoring Report 5 December 2008 
NOC Priorities and Monitoring Report 4 December 2008 

0 Add new document 



Operations Directorate COOP Documents 






Figure 44: HSIN NOC Priorities Retrieval 6 
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7. Reports & Deliverables: 

7.1. Daily Watch Log: 

The MMC maintains an interactive daily log within the Google Documents spreadsheet 
program. The sharable document on Google allows multiple analysts to update 
information within the log at the same tune from different work stations/locations. 

7.1.1. Google Watch Log 

The Internet based Google Documents Log allows analysts on both the MMC and SN 
desks to work cooperatively to insert all relevant information and document all items 
distributed by the MMC. This document is updated expeditiously and consistently 
and includes postings regarding both MMC and SN analyst activities. Analyst 
activities include the distribution of IOIs, posting of media reports to the COP, 
changeover of shift responsibilities, and comrmtnications with the NOC or other 
organizations. It is kept in 24-hour time (military time) and consists of fourteen 
separate sections. 



Figure 45: Daily Watch Log (Google) 


7.1.2. Excel Watch Log 

A copy of the log maintained in Google can be exported to Microsoft Excel file, 
providing the team with a highly functional document for submitting to clients for 
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review. The newly created Excel version of the log allows media analysts, 
supervisors, NOC Staff, and the progr am office (contracts) to assess the daily 
operations of the MMC. The excel log is a functional document used for sourcing 
statistical data and prepar ing daily, weekly, monthly, and ad hoc reports. 
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Figure 46: Daily Watch Log (Excel) 


7.2. Weekly Data Report: 

The MMC Weekly Data Report provides a synopsis of the articles distributed by analysts 
throughout the week. The report provides information on the total number of IOIs 
dispersed during the operational period, the number and type of sources utilized, and a 
review of the IOIs that required follow up messages and/or spurred Awareness or Phase 
Reports and, NOC Notes and NSS/ISSs. The Data Report is also used to track the 
number of Awareness or Phase Updates distributed by the MMC dining the reporting 
period. All of the information for this report is recorded in the daily log. (A sample Data 
Report is located in the appendix section) 

Each Wednesday, the MMC analyst(s) scheduled for Project Time will prepare the MMC 
weekly data report. The analyst sends the data report to management no later than 1100. 
The report will include the following: 
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• Total Number of Distributions - Total number of MMC and SN IOIs, 
Operational Summaries, NOC Phase/Awareness/NOC Notes and Events Of 
High Media Interest Updates, and IOI Updates (follow-ups) 

• Items of Interest Distributed - Total number of IOIs distributed 

• Number of Operational Summaries Distributed - Total number is usually 7 

• NOC Phase/Awareness/NOC Note Updates and Events of High Media 
Interest Updates - Total number of such Updates 

o Expanded List of NOC Phase/Awareness/NOC Note Updates and 
Events of High Media Interest Updates 

• Total Number of IOI Updates - Total number of Updates (follow-ups) IOIs 
distributed 

• Breakdown of Media Sources - How many sources came from live media 
and the internet 

o The number of MMC and SN sources used to support IOIs, Update 
IOIs, Phase, Steady State , and NOC Note Updates, and Operational 
Summaries 

• Number of IOIs that preceded a Phase or Awareness change, or NOC 
Note - list each IOI 

Infonnation for the completion of the Weekly Data Report is easily attained by accessing 
the MMC portal’s report page. A simple tally method can be utilized to verify 
information required for this report. Analysts should count the number of IOIs, 
Operational Summaries, and Updates distributed and then record the totals in their 
designated sections. A data spreadsheet calculator is provided to assist in gathering totals. 

When feasible, the report should be forwarded to other team members for review prior to 
forwarding to the management. The format to use when saving the report is as follows: 

Weekly Data - MMC Data (X Week, X Year) 


7.3. Monthly Data Report: 

The Monthly Situation Report establishes continuity between the MMC and the NOC. 
The report describes the activities of the MMC for the particular month. It includes a 
summary of the team’s activities, details regarding Phases, Media Monitoring Awareness 
articles, and Items of Interest for the month. 

• Summary - this summary will provide a brief description of key events and 
activities performed by MMC and SN teams for the month. For example, if 
the MMC or SN completes a report or adds a new software tool to its 
technology suite of applications - it will be documented in the summary. 

• Tracked Phases, Awareness, and NOC Notes: provides the number of all 
tracked NSS/ISS, Awareness, NOC Notes and the list of IOIs submitted for 
each. 

• Items of Interest: total number of IOIs submitted for the month by both 
MMC and SN teams. 
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The following format will be used for saving the monthly. Save as MMC Monthly Report 
(XMonth, X Year). Print out and post the submitted and reviewed monthly in the MMC 
Distribution Binder. (A sample Data Report is located in the appendix section) 

The monthly report will be written by the analysts on project time as directed by MMC 
leadership. The monthly is due 2-4 business days following the conclusion of the month. 

8. Recurring Training: 

Recurring training will be perfonned on at least a quarterly basis to provide analysts with 
updated guidance and assessments of current operations. Recurring training sessions will 
be utilized to target specific areas of concern and provide opportunities to develop new 
processes and technologies for use within the MMC. Recurring training sessions may 
take the form of physical meetings with all team members gathering in a single location, 
web-based seminar (webinar), or conversations between individual analysts and MMC 
management. All recurring training will be recorded in the Training Log. 

9. NOC Training 

In order to maintain a high degree of readiness, the NOC will issue daily training 
scenarios (when possible) to test the response actions and operational reactions of NOC 
personnel. Although the MMC is located in a satellite office, MMC analysts are expected 
to regularly participate in NOC training sessions, and will often be directly involved in 
the training scenario. 

MM C ana lysts can track the daily training scenarios in both the NOC Training chat room 
on ||||(|U and on the NOC Training tab on HSIN. Scenarios vary from day to day, 
making it absolutely necessary that analysts consistently check the NOC Training HSIN 
page and monitor the NOC Training chat room for updates. Training sessions are 
initiated by the SWO and a message is usually sent out to all NOC participants via 
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Figure 47: NOC Training Tab (HSIN) 


Wlien a training scenari o is initiated, the MMC analyst will read it and respond with both 
a posting to thejjBMMNQC Trai ning chat room, as well as an email to 

The emai l sh ould be BCCT1 to the Projec t Manager, the 
Team Leads and the MMC Desktop Computer 


(b) (6), (b) (7)(C) 


The posting and email will show that the analyst has read the scenario and that either: 

• MMC is not the inject point for this scenario, but would continue to 
monitor open source media outlets and provide situation reports and 
updates for the NOC as applicable. 

• MMC is an inject point for this scenario and would initially generate an 
Item of Interest (IOI). MMC would then continue to monitor open source 
media outlets and provide situation reports and updates for the NOC as 
applicable. If possible, the MMC would seek out video media from the 
scene and generate a video summary to provide additional situational 
awareness to NOC leadership and watch personnel. 
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Figure 48: NOC Training 
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MMC is an mject point fortius scenario and iniciallv generate an Item of Interest .TOT». and then would continue to monitor open source media outlets and provide situation reports and 
updates for the NOC as applicable. If possible, the MMC would seek out video media iroin the scene and generate a video summary to provide additional situational awareness to NOC 
leader ship and watch pet sound 

TRAINING... TRAINING... TRAINING.. TRAINING 


Operations Analyst 


(b) (6), (b) (7)(C) 


Start 3 CF6_M4C_50, . 3 wsete wcntai.... $ sane note mi.,. • i raining JRA... 3 combi. . oahehWeif..., T m rwcftwstB... stuaoonalAw... 


Figure 49: NOC Training Email 
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lO.Responsible Officials 




Andrew Akers 

Contracting Officer’s Representative 

Office of Operations Coordination and Planning 

Department of Homeland Security 


Approval Signature 



Director, National Operations Center 

Office of Operations Coordination and Planning 

Department of Homeland Security 
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Appendix A: Privacy Impact Assessment 

PDF copy follows 
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Appendix B: Media Monitoring Guidance Reminder Memo 


SOP 


Office of Operations Coordination 
and Planning 

U.S. Department of Homeland Security 

Washington, DC 20393 



Homeland 

Security 


MEMORANDUM FOR; National Opcrati'" 1 ' 



FROM: 


Richard Chavez Q_ 1/ /f \ 

Director, Office of Operations Cqforuination and Planning 


SUBJECT: 


Media Monitoring Guidance Reminder 


As part of the fourth Privacy Compliance Review that is scheduled to occur in mid-March 2012, the 
National Operations Center (NOC), in coordination with the DFIS Privacy Office, will review the 2011 
Media Monitoring Analyst’s Desktop Binder, any associated standard operating procedures, and the 
existing media monitoring support services contract to ensure conformity with all Publicly Available 
Social Media Monitoring and Situational Awareness Initiative Privacy Impact Assessments (PIAs) and to 
ensure the scope and purpose of the NOC Media Monitoring Capability (MMC) are accurately reflected 
and recommend clarifications and updates to the language if necessary., In the interim, the NOC will 
continue to use the PlAs as the authoritative source to guide the program. 

The NOC MMC should continue to limit the review, use. collection and dissemination of non-personally 
identifiable information and the seven narrow categories of personally identifiable information to 
information that alTect the operations of the Department of Homeland Security (memorialized in the 
January 2011 PIA). No First Amendment-protected speech relating to dissent or disagreement with the 
Department and its activities should be reviewed, used collected, nr disseminated. 

The MMC can review, use, collect, and disseminate information intended to provide guidance on DI1S 
programs and initiatives that inform the general public. An example would be lire Transportation Security 
Administration's PreCheck program. The MMC can also review, use. and collect information related to 
oversight reports about DUS components such as DTIS Inspector General Reports or Government 
Accountability Office Reports 

The MMC cannot review, use, collect, or disseminate information related to individuals’ positive or 
negative opinions or reports on the Department, but for the narrow circumstance where the MMC reviews 
and informs the relevant Component of an operational issue adversely impacting the Component 
Examples of these issues include security violations at airports or ports of entry, In this narrow 
operational circumstance, no personally identifiable information can be collected, stored, or disseminated 
to the relevant Component. 

cc: Mary Ellen Callahan. Chief Privacy Officer 


WWAV.dh&.ROV 
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Appendix C: PI A Approved Search Terms 

PDF copy follows 
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Appendix D: Credible Traditional Media Source List 


USA Today 
Wall Street Journal 

New York Times 
Los Angeles Times 

Washington Post 
New York Daily News 

Chicago Tribune 

New York Post 
Long Island Newsday 

Houston Chronicle 
San Francisco Chronicle 

New York Newsday 

Arizona Republic 
Chicago Sun-Times 

Boston Globe 

Atlanta Journal-Constitution 

New Jersey Star-Ledger 

Minneapolis Star Tribune 

Detroit Free Press 
Philadelphia Inquirer 

Cleveland Plain Dealer 

St. Petersburg Times 

Portland Oregonian 
San Diego Union-Tribune 

Denver Post 
Rocky Mountain News 

Miami Herald 
Sacramento Bee 
Orange County Register 

St. Louis Post-Dispatch 

Kansas City Star 
San Jose Mercury News 

Detroit News 

New Orleans Times-Picayune 

South Florida Sun-Sentinel 

Indianapolis Star 

Orlando Sentinel 

Baltimore Sun 
San Antonio Express-News 

Columbus Dispatch 
Milwaukee Journal Sentinel 


Tampa Tribune 

Boston Herald 
Pittsburgh Post-Gazette 

Fort Worth Star-Telegram 

Charlotte Observer 

Seattle Times 

Oklahoman 

Louisville Courier-Journal 

Virginian-Pilot 
Cincinnati Enquirer 

Buffalo News 
Omaha World-Herald 

Hartford Courant 
St. Paul Pioneer Press 
Richmond Times-Dispatch 

Riverside Press-Enterprise 

Contra Costa Times 
Arkansas Democrat-Gazette 

Austin American-Statesman 

Palm Beach Post 
Hackensack Record 
Woodland Hills Daily News 

Raleigh News & Observer 

Nashville Tennessean 
Memphis Commercial Appeal 

Florida Times-Union 
Democrat and Chronicle 

Las Vegas Review-Journal 

Fresno Bee 
Providence Journal 

Asbury Park Press 

Birmingham News 

Des Moines Register 
Arlington HTS Daily Herald 

Tulsa World 
Honolulu Advertiser 

Akron Beacon Journal 
Seattle Post-Intelligencer 

Grand Rapids Press 
White Plains Journal News 

Dayton Daily News 
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Toledo Blade 
Salt Lake Tribune 
Tacoma News Tribune 

Sarasota Herald-Tribune 

Knoxville News-Sentinel 

Los Angeles La Opinion 

Philadelphia Daily News 

Syracuse Post-Standard 

Allentown Morning Call 


New Castle News Journal 

Lexington Herald-Leader 

The State Columbia 

Arizona Daily Star 
Daytona BCH News-Journal 

East Valley Tribune 

Albuquerque Journal 
Harrisburg Patriot News 

Fort Myers News-Press 
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Appendix E: PIA Approved SN Source List 

Social Media Web Sites Monitored by the NOC 

• Signed document located on PDF file 


Appendix F: Direct TV Channel List 


A&E 265 
ABC Family 311 

American Movie Classics (AMC) 254 

America’s Store 243 

Animal Planet 282 

BBC America 264 

The Biography Channel 266 

Black Entertainment Television (BET) 329 

Bloomberg Television 353 

Boomerang 297 

Bravo 273 

BYU TV 374 

Cartoon Network 296 

CCTV-9 (Chinese) 455 

The Church Channel 371 

CNBC 355 

CNBC World 357 

CNN 202 

Comedy Central 249 

Country Music Television (CMT) 327 

Court TV 203 

C-SPAN 350 

C-SPAN2 351 

CSTV: College Sports Television 610 

Current TV 366 

Daystar 369 

Discovery Channel 278 

Discovery Health Channel 279 

Discovery Home Channel 286 

Discovery Kids 294 

Discovery Times Channel 285 

DIY Network 230 

E! Entertainment Television 236 

EWTN422 

FINE LIVING 232 

FitTV 368 

Food Network 231 

Fox News Channel 360 

Fox Reality 250 

FUEL TV 612 

Fuse 339 

FX 248 

G4 videogame tv 354 
Galavision 404 
GolTV 426 

Great American Country 326 
GSN: the network for games 309 
Hallmark Channel 312 
Headline News 204 
The History Channel 204 


History International 271 
HITN TVt438 

Home & Garden Television 229 
Home Shopping Network 240 
The Learning Channel (TLC) 280 
Lifetime 252 

Lifetime Real Women 261 
Link TV 375 

The Military Channel 287 
MSNBC 356 
MTV 331 
MTV2 333 

National Geographic Channel 276 

NASA TV 376 

NBA TV 720 

News Mix 102 

NRB Network 378 

NFL Network 212 

Nickelodeon/Nick at Nite (East) 299 

Nickelodeon/Nick at Nite (West) 300 

Nicktoons Network 302 

Noggin/The N 298 

Outdoor Channel 606 

OLN 608 

ONCE Mexicot 415 
Oxygen 251 
QVC317 
RFD-TV 379 
Sci-Fi Channel 244 
Speed 607 
Spike TV 325 
Superstation WGN 307 
TBS 247 

TCT Network 377 
TNT 245 

Travel Channel 277 

Trinity Broadcasting Network (TBN) 372 
Turner Classic Movies (TCM) 256 
Turner South* 631 
TV Guide Channel 224 
TV Land 301 
TV One 241 

TVG:The Interactive Horseracing Network 602 

Univision 402 

USA Network 242 

VH1 335 

VH1 Classic 337 

The Weather Channel 362 

The Word 373 

World Harvest Television (WHT) 321 
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Appendix G: RSS OWL/FeedDemon Watch List 


RSS/Atom feeds embedded within a number of media websites allow analysts to rapidly search 
multiple headlines in order to locate appropriate articles of interest. The FeedDemon and RSS 
OWL programs utilize search parameters created by the analysts to search RSS feeds from a 
variety of media provider websites. The programs sort the articles into relative categories 
providing the analysts with an organized catalog that can be rapidly scanned for relevant items. 

To prevent oversight of important stories due to the massive influx of incoming news stories, 
MMC has incorporated the usage of watch tenns. The watch terms used by MMC encapsulate a 
variety of tenns deemed to be of national/intemational importance. An ability to refresh at any 
time, and the ability to continuously add supplemental feed sources ensures that MMC analysts 
are abreast of breaking stories. 

Watch Folders/ Search Terms: 

• Air Traffic : This watch folder is designed to alert analysts to reports that contain 
information on security breaches at airports across the country, and against U.S. airlines 
around the world. 

Terms: (Airport security breach, Airline, TSA, Airport Police, runway breach) 

• Bird Flu : This watch folder is designed to alert analysts to stories that contain information 
on the infection, spread, and development of technology designed to end contamination 
by the H5N1 Avian Flu virus. 

Terms: (Avian + Flu, Bird + Flu, Flu + Deaths, H5N1, Outbreak) 

• Border Security : This watch folder is designed to alert analysts to stories that contain 
information on incidences involving the U.S. border, immigration, immigration officials, 
and the illegal transfer of products. 

Terms: (Border agent, border crossing, border checkpoint, border guard, border 
incident, border patrol, CIS, Citizenship Immigration Service, cross border, 
Customs Border Protection, FAMS, green card, ICE, Immigration Customs 
Enforcement, illegal immigration, immigrant, immigration, immigration official, 
SBI, Secure Border Initiative, naturalization, smuggler, smuggling) 

• Chemical Spill : This watch folder is designed to alert analysts to reports that contain 
information regarding terrorist attacks involving chemical weapons, Hazardous Materials 
Incidents (HAZMAT), and industrial chemical releases or spills. 

Terms: (Chemical + Spill, HAZMAT, Hazardous + Materials) 

• Domestic Security/Response : This watch folder is designed to alert analysts to reports 
relating to emergency response organizations, as well as emergency situations 
themselves. 

Terms: (Coast Guard, USCG, dirty bomb, disaster, disaster assistance, DNDO, 
Domestic Nuclear Detection, emergency response, FEMA, Federal Emergency 
Management Association, Homeland Security Headquarters, Homeland Security 
Operations, Maritime Domain Awareness, MDA, National Preparedness 
Initiative, National Operations Center, NOC, nuclear facility, nuclear release, 
nuclear threat, radioactive, Secret Service, USSS) 



• Earthquake : This watch folder is designed to alert analysts to reports that contain 
information on earthquakes and related seismic events throughout the world. 

Terms: (Earthquake, Earthquake +Destruction, Seismic, Richter + Scale) 

• Evacuation : This watch folder is designed to alert analysts of infonnation regarding 
evacuations due to weather, terrorist, or public safety incidents/ threats. 

Terms: (Evacuation, Shelter, Evacuated) 

• Explosion : This watch folder is designed to provide analysts with open source 
intelligence on explosions as a result of terrorist attacks, domestic threats, and industrial 
accidents. 

Terms: (Bomb, Explosion, Explosives, Improvised + Explosive + Device, IED) 

• Infrastructure Security : This watch folder is designed to provide analysts with 
information on incidences relating to the security of airports, bridges, cyberspace, etc. 

Terms: (Airport, airport security, biological, biological infection, chemical bum, 
chemical fire, chemical, computer emergency readiness, computer infrastructure, 
epidemic, hazardous material incident, HAZMAT, industrial spill, infection, 
national infrastructure, NBIC, nuclear, pandemic, Transportation Security 
Administration, TSA, USCERT) 

• Nuclear Incident : This watch folder is designed to provide analysts with information 
regarding nuclear activity in the U.S. and abroad as relates to U.S. interests. 

Terms: (Nuclear, radiation, radiological, radiological dispersal devices) 

• Suspicious Package : This watch folder is designed to provide analysts with information 
regarding suspicious packages that may be linked to some fonn of terroristic threat. 

Terms: (Suspicious + Package, Suspicious + Powder, Powder, Suspicious) 

• Terrorism : This watch folder is designed to gather articles and infonnation on the 
activities of terror networks as well as government agencies working to disrupt the 
operations of those groups. 

Terms: (Bombs, International + Terrorism, Terror + Plot, Tenorist + Cell, 
Terrorist + Group, Terrorist + Operative) 

• Train Derailment : This watch folder is designed to provide analysts with information on 
the damage and death toll following train derailments within the United States. 

Terms: (Train, Train + Derailment, Railway, Train + Wreck) 

• Wildfire : This watch folder is designed to provide analyst with reports on the spread of, 
damage caused by, and issues resulting from wildfires throughout the nation. 

Terms: (Wildfire, Brushfire, Fire) 
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Appendix H: MMC Data Report (Example) 


Media Monitoring Capability 
MMC Data report for 13 July 2011-19 July 2011 

Includes both traditional and new media 

Total Number of Distributions: 334 

o Traditional Media: 192 (of which 6 were LIMDIS) 
o New Media: 142 (of which 10 were LIMDIS) 

• Total Number of (IOI) messages distributed: 181 

• Total Number of Operational Summaries: 7 

• Total Number of NOC Phase/Awareness Updates and Events of High Media Interest 
Updates distributed: 5 

o NOC 0837-11: Wildfire - Oklahoma (1) 
o NOC 0840-11: Excessive Heat Wave - US (2) 

o NOC 0013-11-156: Suspicious Envelope With Possible Powder - Washington, 
DC (2) 

• Total Number of (IOI) Updates (follow-ups) distributed: 141 


• Breakdown of Media Sources: 366 

o Internet (AP, National, State and local news sites or new media): 366 
o Live Broadcast: 0 

• Number of IOIs that preceded NOC Phase reports, Steady State reports or NOC Notes: 1 
o Steady State 0837-11: Wildfire - Oklahoma; Preceded by "UPDATE #1—Edmond 

Fire Burns 250 Acres, Crews Monitoring Hot Spots - Oklahoma—MMC IOI #3 712- 
II" by approximately 18 hours 
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Appendix I: MMC Monthly Report (Example) 

MEDIA MONITORING CAPABILITY MONTHLY REPORT 

January 2012 


During the operational period of January 2012, Media Monitoring Capability (MMC) analysts 
performed open source monitoring of both traditional and social (referred to as “new”) media in 
an organized effort to provide real time information and situational awareness on breaking news 
stories relevant to DHS. Information was summarized and distributed to the National Operations 
Center (NOC)-directed distribution list and/or the Common Operating Picture (COP). 

Analysts utilized traditional live media feeds, such as CNN, Fox News, MSNBC, and local cable 
stations; and new media, such as blogs, Twitter, and picture-based forums, as well as various 
news feeds such as FeedDemon/RSSOwl, Meltwater and Tweetdeck, to identify key open source 
information that had national/international significance. Sifting through thousands of news 
stories or posts and classifying each on its national/intemational importance to United States’ 
welfare and interest, MMC analysts submitted the resulting information through Items of Interest 
(IOI), Steady State Updates, and National/intemational Situation Summary Updates (NSS/ISS). 
A summarized report on the number of media reports distributed in support of such items can be 
reviewed below. 

Throughout January, MMC analysts distributed a wide range of IOIs. In 10 cases, proactive 
reporting by the MMC may have spurred the creation of NOC Notes, NOC Numbered Items, 
Steady State Reports, or NSS Reports. Infonnation regarding these reports can be reviewed 
below. 

Coverage 

MMC analysts maintained coverage seven days per week. Coverage was supported through 
weekday, weekend, and holiday shift work. 

January Report Totals 

• National Situation Summary/International Situation Summary, Steady State Reports: 


NOC Phase/ Awareness MMC Updates Submitted 

• NOC 0012-11-621 Explosives Lab - Torrance County, NM 1 

• NOC 0012-12-003 Suspicious Package - Retail Shopping Center - Charlotte, NC 1 

• NOC 0012-12-005 Hazmat Call -Palm Beach County, FL 3 

• NOC 0012-12-006 Unknown White Powder-Ft. Pierce, FL 3 

• NOC 0012-12-008 Suspicious Package - Riviera Beach, FL 1 

• NOC 1261-11 Fuel Delivery - Nome, AK 37 

• NOC 1155-11 Russian Spacecraft Re-Entry 5 

• NOC 1182-11 2012 Tournament of Roses Parade - Rose Bowl - Pasadena, CA 2 

• NOC 1260-11 Suspicious Item In Carry-On - Midland, TX 1 
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NOC 0012-11-010 Suspicious Device - Springfield, OH 2 

NOC 0012-12-009 Suspicious Device - King Of Prussia Mall, PA 2 

NOC 0012-12-011 Suspicious Package - Orlando, FL 2 

NOC 0012-12-015 Suspicious Package - South Seattle, WA 3 

NOC 0014-12-003 Train Collision - Coburg, IN 4 

NOC 0021 -12 Wildfires - Montana 4 

NOC 0022-12 Alert At Prairie Island 1 Nuclear Power Plant - St. Paul, MN 3 
NOC 0025-12 U.S. Research Vessel Sinking With 40 POB - O'ahu, HI 1 

NOC 0032-12 Earthquake - Off West Coast of Northern Sumatra 3 

NOC 0012-12-024 Hazmat/Suspicious Items - AZ/UT Border 1 

NOC 0012-12-027 Hazmat Spill - Hot Spring County, AR 3 

NOC 0012-12-028 Explosive Device At High School - Austin, TX 2 

NOC 0012-12-032 Suspicious Package - Orlando, FL 1 

NOC 0014-12-008 Synagogue Attacks - New Jersey 2 

NOC 0014-12-012 Italian C/S Grounding Near Tuscany 45 

NOC 0014-12-013 Gas Line Explosion - West Haverstraw, NY 4 

NOC 0014-12-014 Major Snow Storm - Seattle, WA 13 

NOC 0034-12 Severe Weather - North Carolina 2 

NOC 0012-12-045 Suspicious Package - Austin, TX 3 

NOC 0012-12-046 Residential Explosion - Queens, NY 2 

NOC 0012-12-047 Hazmat Situation - Consulate Of Israel - Boston, MA 3 


• NOC 0013-12-005 Possible Armed Suspect - Tyndall AFB - Panama City, FL 1 


NOC 0014-12-017 Wake Tech Lockdown - Raleigh, NC 1 

NOC 0050-12 Severe Weather - Northwest, U.S. 67 

NOC 0060-12 DOJ Website Denial Of Service Attack 4 

NOC 0062-12 Washoe Fire - Washoe County, NV 13 

NOC 0068-12 Severe Weather - Southeast U.S. 11 

NOC 0071-12 Suspicious Powder Incidents - Israeli Consulates 8 

NOC 1234-11 Super Bowl - Indianapolis, IN 8 

NOC 0003-12-002 Shots Fired Involving DHS Personnel 1 

NOC 0012-12-049 Suspicious Package - Arlington National Cemetery 1 

NOC 0012-12-050 Suspicious Package - New York, NY 2 

NOC 0012-12-053 Washington State Ferry 2 

NOC 0012-12-057 Suspicious Package - San Ysidro, CA 1 

NOC 0012-12-058 Hazmat Situation - Edwardsville, IL 3 

NOC 0014-12-021 Furnace Explosion - Norton Shores, MI 3 

NOC 0084-12 Bridge Collapse - Marshall County, KY 8 


TOTAL: 294 

National/International Situation Summaries (NSS) possibly generated by MMC IOI: N/A 

NOC Notes, NOC Numbered Items & Awareness/Phase Reports possibly generated by 
MMC IOI: 23 

• NOC 0012-12-005 Hazmat Call - Palm Beach, FL; preceded by Authorities Investigating White 
Powder At State Attorney's Office - Palm Beach County, FL—MMC IOI #0032-12 ” by 
approximately 17 minutes 


86 




SOP 


• NOC 0012-12-008 Suspicious Package - Riviera Beach, FL; preceded by ‘‘Authorities 
Investigating Suspicious Package; Nearby Businesses Evacuated - Riviera Beach, FL—MMC101 
#0045-12 ” by approximately 2 minutes 

• NOC 0012-12-014 Call-in Bomb Threat - Culpeper Courthouse, VA; preceded by Bomb Threat 
Prompts Courthouse Evacuation - Culpeper County, VA—MMCIOI #0094-12 by approximately 1 
hour, 6 minutes 

• NOC 0014-12-003 Train Collision - Coburg, IN; preceded by UPDATE #1—Up To 3 Trains 
Involved In Porter County Collision, Ethanol Spill Reported At Scene - Indiana—MMC IOI 
#0098-12 by approximately 21 minutes 

• NOC 0021-12 Wildfires - Montana; preceded by UPDATE #2—Wind-Whipped Wildfires Burning 
Over 10,000 Acres Near Browning, MT—MMC IOI #0063-12 by approximately 29 minutes 

• NOC 0025-12 U.S. Research Vessel Sinking With 40 POB - O'ahu, HI; preceded by Coast Guard 
Rescues Forty From Sinking Research Vessel Off Hawaii Coast—MMC IOI #0101-12 by 
approximately 1 hour, 20 minutes 

• NOC #0012-12-013 Suspicious Device - Spring Hill, FL; preceded by Tampa Bay Authorities 
Investigating Potentially Explosive Device Described As Pipe Bomb - Spring Hill, Florida—MMC 
IOI #0077-12 by approximately 4 minutes 

• NOC 0012-12-024: Hazmat/Suspicious Items - AZ/UT Border; preceded by “UPDATE #3— 
HAZMAT Team Investigating Suspect's Car; No Explosive Devices In Suspicious Boxes - 
Arizona—MMC IOI #0173-12 ” by approximately 15 minutes 

• NOC 0012-12-026: Grenade Investigation - Orange County, FL; preceded by “Authorities 
Investigating Report Of Grenade Thrown From Moving Vehicle - Orange County, Florida—MMC 
IOI #0191-12” by approximately 15 minutes 

• NOC 0014-12-008: Synagogue Attacks - New Jersey; preceded by “Jewish Leaders Request 
Extra Police Security Amid Synagogue Attacks - New Jersey—MMC IOI #0195-12 ” by 
approximately 45 minutes 

• NOC 0034-12: Severe Weather - North Carolina; preceded by “UPDATE #1—Tornado Severely 
Damages At Least 30 Homes - Rutherford And Burke Counties, NC—MMC IOI #0194-12 ” by 
approximately 1 hour and 20 minutes 

• NOC 0012-12-032: Suspicious Package - Orlando, FL; preceded by “Authorities Investigate 
Suspicious Package At University Of Central Florida - Orlando—MMC IOI #0236-12 ” by 
approximately 45 minutes 

• NOC 0014-12-012: Italian C/S Grounding Near Tuscany; preceded by “69 Missing, 3 Dead After 
Cruise Ship Runs Aground In Italy; 129 Americans Aboard—MMC IOI #0249-12 ” by 
approximately 35 minutes 

• NOC 0014-12-013: Gas Line Explosion - West Haverstraw, NY; preceded by “Gas Leak Causes 
Explosion, Prompts Evacuations - West Haverstraw, NY—MMC IOI #0276-12 ” by approximately 
2 minutes 

• NOC 0014-12-014: Major Snow Storm - Seattle, WA; preceded by “UPDATE #2—Preparations 
Underway For Major Snow Storm - Seattle, WA—MMC IOI #0275-12 ” by approximately 15 
minutes 

• NOC 0060-12: DOJ Website Denial Of Service Attack; preceded by “Anonymous Shuts Down 
U.S. Government Websites—MMC IOI #0341-12 ” by approximately 9 minutes 
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• NOC 0062-12: Washoe Fire, Washoe County, NV; preceded by “Brush Fire South Of Reno 
Burns Homes, Forces Evacuations; U.S. 395 Closed - NV—MMC101 #0340-12 ” by 
approximately 2 hours and 9 minutes 

• NOC 0013-12-005: Possible Armed Suspect - Tyndall AFB - Panama City, FL; preceded by 
“Tyndall Air Force Base On Lockdown Amid Unconfirmed Reports Of Shots Fired - FL—MMC 
IOI #0365-12 ” by approximately 4 minutes 

• NOC 0068-12: Severe Weather - Southeast U.S.; preceded by “Update #9—Alabama Emergency 
Personnel Searching For Trapped Residents; Two Fatalities Confirmed—MMC IOI #0361-12 ” 
by approximately 15 minutes 

• NOC #0012-12-049 [Suspicious Package - Arlington Natl Cemetery]; preceded by “Suspicious 
Package Prompts Arlington National Cemetery Metro Station, Roadway Closures - VA—MMC 
IOI #0430-12 ” by approximately 4 minutes 

• NOC #0012-12-058 Hazmat Situation - Edwardsville, 1L; preceded by “Crews Treating Tanker- 
Crash Into Warehouse As Hazmat Situation - Edwardsville, IL—MMC IOI #0480-12 ” by 
approximately 25 minutes 

• NOC #0014-12-021: Furnace Explosion - Norton Shores, Ml; preceded by 'Emergency Crews 
Responding To Furnace Explosion At Foundry Facility - Norton Shores, Michigan—MMC IOI 
#0520-12" by approximately 11 minutes 

• NOC 0012-12-062 [White Powder - Phoenix, AZ]; preceded by “Envelope Containing White 
Powder Addressed To U.S. President, Listed AZ Sheriff As Sender - Phoenix—MMC IOI #0524- 
12 ” by approximately 10 minutes 


Items of Interest Distributed: 

• MMC distributions 

o 1,477 Total Items distributed 

■ Traditional Media: 776 (of which 18 were LIMDIS) 

■ New Media: 696 (of which 31 were LIMDIS) 
o 545 Items of Interest (IOI) distributed 

o 607 Updates to IOIs distributed 
o 294 Phase/ Awareness Updates distributed 
o 31 Operational Summaries distributed 

• 2,764 Sources Used 
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